gf

This is tomnomnom's tool gf so all credit goes to him, I just modified the code according to my requirements.

Installation

go install github.com/rix4uni/gf@latest

Download prebuilt binaries

wget https://github.com/rix4uni/gf/releases/download/v0.0.2/gf-linux-amd64-0.0.2.tgz
tar -xvzf gf-linux-amd64-0.0.2.tgz
rm -rf gf-linux-amd64-0.0.2.tgz
mv gf ~/go/bin/gf

Or download binary release for your platform.

Compile from source

git clone --depth 1 github.com/rix4uni/gf.git
cd gf; go install

Usage

Usage of gf: --list list vulnerability types or priority groups --no-color disable colored output --remaining show unmatched URLs --silent Silent mode. --version Print the version of the tool and exit. --vuln string vulnerability type (xss, sqli, lfi)

Vulnerability List

gf --silent --listsstisecret_extsecret_subsxsssqlilfissrfsecret_urlrceidorredirect

XSS Vulnerability Priority

gf --silent --list --vuln xss
# Priority1 Flags: -aiE Pattern: (\?|&)(q=|s=|search=|query=|keyword=|text=|name=|value=|input=|term=)
# Priority2 Flags: -aiE Pattern: (\?|&)(msg=|message=|comment=|content=|title=|desc=|description=|body=|subject=|label=)
# Priority3 Flags: -aiE Pattern: (\?|&)(id=|page=|type=|category=|lang=|theme=|sort=|filter=|view=|error=)

Examples

cat urls.txt | urldedupe -s | gf --silent --vuln xsscat urls.txt | gf --silent --vuln secret_ext

Output