Skip to content

cli.md

Latest commit

 

History

History
129 lines (97 loc) · 4.03 KB

cli.md

File metadata and controls

129 lines (97 loc) · 4.03 KB
Raw

CLI

Everything the control panel does is available on the command line.

wes [--home DIR] <command> [options]

Two conventions apply throughout:

  • An <instance> may be given as its id, an unambiguous id prefix, or an unambiguous part of its label. An ambiguous reference is refused with the candidates listed.
  • Flags are read wherever they appear, before or after positional arguments.

Most listings accept --json.

Any group prints its own usage:

wes help              # everything
wes instance help     # just the instances
wes log help

-h and --help work the same way, as does wes help instance.

Serving

Command Description
run [flags] Start the listeners
health Exit 0 while the listeners answer
version Print the version

Instances

Command Description
instance ls List instances with file, log and mail counts
instance new [--label L] [--ttl SECONDS] [--host NAME] Create one
instance show <instance> Detail, including every stored path
instance host <instance> <name>
instance host <instance> --clear		 Set or clear a name of its own
instance on|off <instance> Start or stop answering, keeping the evidence
instance expire <instance> --ttl SECONDS
instance expire <instance> --never		 Change the expiry
instance prune [--force] Delete everything that has expired
instance rm <instance> Delete it and everything it holds

Stored responses

Command Description
response ls <instance> List stored paths
response get <instance> <path> [--head|--body] Read one back
response put <instance> <path> <file|-> Store one
response rm <instance> <path> Delete one

store is an alias for response put. It accepts --head, --head-file, --mode normal\|raw\|verbatim and --no-https.

echo '<script>fetch("/x")</script>' | wes store acme /exploit -
wes store acme /r - --mode raw --head 'HTTP/1.1 302 Found
Location: /'

Access log

Command Description
log <instance> [--limit N] [--raw] [--follow] Print the log
log show <instance> <entry-id> One request in full
log clear <instance> --force Discard it 
wes log acme --follow    # callbacks as they arrive

Captured mail

Command Description
mail [instance] [--limit N] List messages. Without an instance, lists all
mail show <message-id> [--raw] One message
mail clear <instance> --force Discard them

Payload library

Command Description
payloads ls [--restore-defaults] List the library
payloads show <payload> [--body] Print one
payloads add --name N <file|-> Add or replace one
payloads rm <payload> Delete one
payloads render <payload> [--instance I] [--target URL] [--store PATH] Substitute placeholders
payloads export
payloads import <file|->		 Move the library as JSON

render substitutes {{ORIGIN}}, {{ORIGIN_HOST}}, {{TARGET}} and {{TARGET_HOST}}. With --store it writes the result straight onto an instance:

wes payloads render xss-cookie \
  --instance acme --target https://app.example.com --store /exploit

Configuration

Command Description
config Summary, including panel credentials
config list [--json] Every setting and its value
config get <key> One setting
config set <key> <value>... Edit config.json
config path Where the file lives
config --reset-password Generate a new panel password

See Configuration for what each setting does.

Deleting evidence

Commands that discard evidence require --force:

  • log clear and mail clear
  • instance prune
  • instance rm, when the instance was named by prefix or label rather than by its full id

An exact instance id deletes without confirmation.