gf

This is tomnomnom's tool gf so all credit goes to him, I just modified the code according to my requirements.

Installation

go install github.com/rix4uni/gf@latest

Download prebuilt binaries

wget https://github.com/rix4uni/gf/releases/download/v0.0.2/gf-linux-amd64-0.0.2.tgz
tar -xvzf gf-linux-amd64-0.0.2.tgz
rm -rf gf-linux-amd64-0.0.2.tgz
mv gf ~/go/bin/gf

Or download binary release for your platform.

Compile from source

git clone --depth 1 github.com/rix4uni/gf.git
cd gf; go install

Usage

Usage of gf:
      --list          list vulnerability types or priority groups
      --no-color      disable colored output
      --remaining     show unmatched URLs
      --silent        Silent mode.
      --version       Print the version of the tool and exit.
      --vuln string   vulnerability type (xss, sqli, lfi)

Vulnerability List

gf --silent --list

ssti
secret_ext
secret_subs
xss
sqli
lfi
ssrf
secret_url
rce
idor
redirect

XSS Vulnerability Priority

gf --silent --list --vuln xss

# Priority1
  Flags:   -aiE
  Pattern: (\?|&)(q=|s=|search=|query=|keyword=|text=|name=|value=|input=|term=)

# Priority2
  Flags:   -aiE
  Pattern: (\?|&)(msg=|message=|comment=|content=|title=|desc=|description=|body=|subject=|label=)

# Priority3
  Flags:   -aiE
  Pattern: (\?|&)(id=|page=|type=|category=|lang=|theme=|sort=|filter=|view=|error=)

Examples

cat urls.txt | urldedupe -s | gf --silent --vuln xss
cat urls.txt | gf --silent --vuln secret_ext

Output