Metadata-Version: 2.4
Name: netbear
Version: 0.1.3
Summary: Browser-observed web intelligence platform
Author: NetBear Authors
License: AGPL-3.0-or-later
Classifier: License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Programming Language :: Python :: 3.14
Requires-Python: <3.15,>=3.8
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: fastapi<1.0,>=0.95
Requires-Dist: uvicorn<1.0,>=0.20
Requires-Dist: rich<15.0,>=13.0
Requires-Dist: beautifulsoup4<5.0,>=4.12
Requires-Dist: playwright<2.0,>=1.34
Requires-Dist: psycopg[binary]<4.0,>=3.0
Requires-Dist: redis<5.0,>=4.5
Requires-Dist: httpx<1.0,>=0.24
Requires-Dist: pydantic<2.0,>=1.10
Requires-Dist: requests<3.0,>=2.28
Requires-Dist: tldextract<4.0,>=3.4
Requires-Dist: typing-extensions; python_version < "3.11"
Requires-Dist: importlib-metadata; python_version < "3.8"
Provides-Extra: dev
Requires-Dist: pytest<8.0,>=7.0; extra == "dev"
Requires-Dist: pytest-asyncio<1.0,>=0.21; extra == "dev"
Requires-Dist: black<25.0,>=24.0; extra == "dev"
Provides-Extra: pydantic2
Requires-Dist: pydantic<3.0,>=2.0; extra == "pydantic2"
Dynamic: license-file

# NetBear

NetBear is a browser-observed web exposure intelligence platform for authorized
security testing. It uses Playwright-driven crawling to observe pages, requests,
responses, JavaScript assets, forms, headers, and generated artifacts so testers
can understand a target's exposed surface before deeper manual validation.

NetBear is intended for systems you own or have explicit permission to test.

## What NetBear Does

- Crawls web applications with a real Chromium browser.
- Reuses authenticated browser state for logged-in scans.
- Enforces target scope rules before scanning.
- Captures HAR, cURL replay files, screenshots, JavaScript, JSON/XHR responses,
  fingerprints, and crawl summaries.
- Extracts links, forms, GET parameters, endpoint literals, DOM XSS sink hints,
  auth storage patterns, and backend fingerprint signals.
- Can run Nuclei after crawling when the external `nuclei` binary is available.
- Provides CLI commands for local scans and generated artifacts.
- Holds the local API/dashboard entrypoint back while the UI is refactored.

## Installation

Install from PyPI:

```console
python -m pip install netbear
python -m playwright install chromium
netbear-check
```

Install from PyPI when validating pre-release builds:

```console
python -m pip install --index-url https://pypi.org/simple/ --extra-index-url https://pypi.org/simple/ netbear
python -m playwright install chromium
netbear-check
```

Installation from PyPI :

```bash
python -m pip install --upgrade pip setuptools wheel
python -m pip install netbear
python -m playwright install chromium
netbear-check
```

Installation from PyPI (pre-release validation):

```bash
python -m pip install --upgrade pip setuptools wheel
python -m pip install --index-url https://pypi.org/simple/ --extra-index-url https://pypi.org/simple/ netbear
python -m playwright install chromium
netbear-check
```


## Quick Start

Create starter target and scope files:

```console
netbear-init --targets targets.txt --scopes scopes.txt
```

Edit both files before scanning. `targets.txt` should contain URLs you are
authorized to test. `scopes.txt` should contain the domains or wildcard domains
NetBear is allowed to crawl.

Run a dry run first:

```console
netbear-crawl --targets targets.txt --scopes scopes.txt --dry-run
```

Run a browser crawl without Nuclei:

```console
netbear-crawl --targets targets.txt --scopes scopes.txt --no-nuclei
```

List recent crawl runs:

```console
netbear-runs
```

Inspect the latest run's artifacts:

```console
netbear-artifacts --run latest
netbear-artifacts --run latest --show summary
netbear-artifacts --run latest --show curl-summary
```

Preview safe replay confirmations from filtered crawl requests:

```console
netbear-replay --run latest
netbear-replay --run latest --limit 20
```

Send the selected safe replay requests only when you are authorized:

```console
netbear-replay --run latest --execute
```

Limit crawl size while testing:

```console
netbear-crawl --targets targets.txt --scopes scopes.txt --max-depth 2 --max-pages 15 --delay 1.5 --no-nuclei
```

The `netbear-api` and `netbear-worker` commands are currently present for
compatibility, but they exit with clear messages instead of starting the
unfinished API/dashboard queue path.

## CLI Commands

```console
netbear commands
netbear help netbear-crawl
netbear-check
netbear-init --help
netbear-crawl --help
netbear-runs --help
netbear-artifacts --help
netbear-replay --help
netbear-worker --help
```

## Common Environment Variables

- `NETBEAR_TARGETS_FILE`: default target file for CLI crawls.
- `NETBEAR_SCOPES_FILE`: default scope file for CLI crawls.
- `NETBEAR_MAX_DEPTH`: crawl depth limit.
- `NETBEAR_MAX_PAGES_PER_DOMAIN`: page limit per domain.
- `NETBEAR_RATE_LIMIT_SEC`: delay between requests/actions.
- `NETBEAR_REPORTS_DIR`: output directory for generated reports.
- `NETBEAR_NUCLEI_ENABLED`: enable or disable Nuclei integration.
- `NETBEAR_NUCLEI_RUN_AFTER_CRAWL`: run Nuclei after crawl completion.

## Outputs

NetBear writes run artifacts under the configured reports directory. Typical
outputs include:

- `CRAWL_SUMMARY.txt`
- `report.txt`
- HAR exports
- full and filtered cURL replay scripts
- captured JavaScript files
- captured JSON/XHR files
- screenshots
- backend fingerprint JSON
- JavaScript structure JSON
- optional Playwright traces
- generated fuzzing guidance

## License

NetBear open-core releases are licensed under the GNU Affero General Public
License v3.0 or later (`AGPL-3.0-or-later`). See `LICENSE` for details.
