tomnomnom / qsreplace Goto Github PK

Accept URLs on stdin, replace all query string values with a user-supplied value

License: MIT License

Go 54.13% Shell 45.87%

qsreplace's Introduction

qsreplace

Accept URLs on stdin, replace all query string values with a user-supplied value, only output each combination of query string parameters once per host and path.

Usage

Example input file:

▶ cat urls.txt 
https://example.com/path?one=1&two=2
https://example.com/path?two=2&one=1
https://example.com/pathtwo?two=2&one=1
https://example.net/a/path?two=2&one=1

Replace Query String Values

▶ cat urls.txt | qsreplace newval
https://example.com/path?one=newval&two=newval
https://example.com/pathtwo?one=newval&two=newval
https://example.net/a/path?one=newval&two=newval

Append to Query String Values

▶ cat urls.txt | qsreplace -a newval
https://example.com/path?one=1newval&two=2newval
https://example.com/pathtwo?one=1newval&two=2newval
https://example.net/a/path?one=1newval&two=2newval

Remove Duplicate URL and Parameter Combinations

You can omit the argument to -a to only output each combination of URL and query string parameters once:

▶ cat urls.txt | qsreplace -a 
https://example.com/path?one=1&two=2
https://example.com/pathtwo?one=1&two=2
https://example.net/a/path?one=1&two=2

Install

With Go:

▶ go install github.com/tomnomnom/qsreplace@latest

Or download a release and put it somewhere in your $PATH (e.g. in /usr/local/bin).

qsreplace's People

Contributors

Stargazers

Watchers

Forkers

hax0rg1rl inosec2 avineshwar c0dak laowang1026 5l1v3r1 shubhamgupta0x0 hayageek zaidozaid slooppe pentest-tools tibug sbim polling-repo-continua jeanfredson vishal9066 ankurvaishley th3cyb3rc0p wdahlenburg mohams3c bananabr grandzero gscr10 mominul0x01 yagamishadow reconjry deepanjalkumar prongedfork fajaratp inyongnation brycereynolds elamaran619 lalkaltest afwu karmaz95 jhonjairo-coder anassedemnati keyur-dasarwar mihailotomic trickest-community kodjob bhishma14 storenth leomatias normadchief madusec optionalg araselmir skye96 liupanxuexi ofjaaah gprime31 marlborojamez ahmetgurel elsherifx00 tamersp25 guleum soulinux burak40 daovangiang 0xsojalsec adelittle demon1k hiennv20 earendel3301 nullfuzz-pentest st3rven b1ue0ceanrun paulinhoneto blackhatethicalhacking hartl3y94 davidbalas1 attrib07 dingyshark zerodivisi0n sylviagaytaneh2021 crackd3vil lcsouzamenezes et3rn4ldr34d assassinukg chirag-2431 tommalvoriddle seleket21 th3cr4zycl4y raindouble xmardus 0xbool vinnyvinoth misterhk rassec ahmetqara scriptkkiddie dimopouloselias papyrusdo basantbhandari joaovitormaia agentjacker data-gami fixerman 0xy4q

qsreplace's Issues

Add an option to not url encode.

currently it works like: qsreplace "https://site.com" ---> param=https%3A%2F%2Fsite.com
can you add an option to not url encode? ---> param=https://site.com

Parameter Edge Case

Hey Tom,

I found an edge case where the parameters in a link don't get replaced. Here's an example url:
http://fakedomain.com/fakefile.jsp;jsessionid=2ed4262dbe69850d25bc7c6424ba59db?hardwareid=14&tarifid=9998

There's no way to target specific params

Copy+paste from Slack convo:

I've got a few ideas to make it more useful
Mostly, match (with regex) the param name or the value to replace

So you could, for example, do something like cat urls.txt | qsreplace --match-value='^https?://' https://lksjdklsdg.burpcollab or something like that

or cat urls.txt | qsreplace --match-key='.*redirect.*' //evil.com

Or cat urls.txt | qsreplace --match-value='[0-9]+' -a '+sleep(1)'

Does not work with *

does not work with * char for some reason.

example: cat urls.txt | qsreplace *

qsreplace is not working with xss payload

When I put xss payload it say

-bash: syntax error near unexpected token `('

[question][feature request] Do we need one more positional parameter

Hi there,
Test data from wayback machine and noted the next actual behavior:

echo "fr/prendre-rendez-vous?pageId" | qsreplace http://127.0.0.1:8080
fr/prendre-rendez-vous?pageId=http%3A%2F%2F127.0.0.1%3A8080

I expected the behavior to be:

fr/prendre-rendez-vous?pageId=http://127.0.0.1:8080

Any ideas? Please share your thoughts! Thanks!

qsreplace does not replace each parameter only once

Perhaps I am misunderstanding how qsreplace is intended to work, but considering the description of the tool, I am receiving unexpected output. qsreplace is replacing every parameter value, not individually.

~ % cat urls.txt 
https://www.evildojo.com/index.php?q=search&name=darkmage
https://www.evildojo.com/index.php?q=search
https://www.evildojo.com/index.php
https://www.evildojo.com

~ % cat urls.txt | qsreplace d3v
https://www.evildojo.com/index.php?name=d3v&q=d3v
https://www.evildojo.com/index.php?q=d3v
https://www.evildojo.com/index.php
https://www.evildojo.com

The output I am expecting, however, is below:

https://www.evildojo.com/index.php?q=d3v
https://www.evildojo.com/index.php?q=d3v&name=darkmage
https://www.evildojo.com/index.php?q=search&name=d3v

I am releasing a tool to achieve this functionality, but I think it would be nice if this tool did it instead.

Install with go

Install with go get is no longer working with the latest go version

qsreplace does not use with file

Hello Tomnomnom,

You Know That this tool using for replace just text not a file ,In some case the user need to replace file instead text.

Best Regards..