browser_get_dom
Extract security-relevant DOM structure from the current page, including forms, links, scripts, iframes, comments, event handlers, and data attributes, for initial reconnaissance after navigation.
Instructions
Extract security-relevant DOM structure from the current page. Returns data the PROXY CANNOT SEE.
PREREQUISITE: browser_open and browser_go must have been called first.
Automatically extracts:
Forms: action URLs, methods, input fields, hidden inputs, CSRF tokens
Links: all href values
Scripts: src attributes (for finding JS endpoints)
Iframes: embedded frame sources
HTML comments: developers often leave sensitive info in comments
Event handlers: onclick, onsubmit, etc. (for client-side logic)
data-* attributes: often contain API endpoints or config values
Simplified DOM tree (depth-limited)
Use this for initial recon after navigating to a page.
Args: selector: Root element CSS selector to analyze (default: "body" = entire page) max_depth: How deep to traverse the DOM tree (default: 4). Higher = more detail but more tokens. session_name: Browser session to use (default: "default")
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| tab_id | No | ||
| selector | No | body | |
| max_depth | No | ||
| session_name | No | default |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |