A Python Instrument Used To Uncover Endpoints (And Potential Parameters) For A Given Goal

Set up

xnLinkFinder helps Python 3.

$ git clone https://github.com/xnl-h4ck3r/xnLinkFinder.git
$ cd xnLinkFinder
$ sudo python setup.py set up

Utilization

† NOT RELEVANT FOR INPUT OF DIRECTORY, BURP XML FILE OR OWASP ZAP FILE

config.yml

The config.yml file has the keys which might be up to date to fit your wants:

• linkExclude – A comma separated checklist of strings (e.g. .css,.jpg,.jpeg and so forth.) that each one hyperlinks are checked in opposition to. If a hyperlink consists of any of the strings then it is going to be excluded from the output. If the enter is a listing, then file names are checked in opposition to this checklist.
• contentExclude – A comma separated checklist of strings (e.g. textual content/css,picture/jpeg,picture/jpg and so forth.) that each one responses Content material-Kind headers are checked in opposition to. Any responses with the these content material varieties shall be excluded and never checked for hyperlinks.
• fileExtExclude – A comma separated checklist of strings (e.g. .zip,.gz,.tar and so forth.) that each one recordsdata in Listing mode are checked in opposition to. If a file has a type of extensions it is not going to be looked for hyperlinks.
• regexFiles – A listing of file varieties separated by a pipe character (e.g. php|php3|php5 and so forth.). These are used within the Hyperlink Discovering Regex when there are findings that are not apparent hyperlinks, however are fascinating file varieties that you just need to pick. Should you add to this checklist, make sure you escape any dots to make sure appropriate regex, e.g. js.map
• respParamLinksFound † – Whether or not to get potential parameters from hyperlinks present in responses: True or False
• respParamPathWords † – Whether or not so as to add path phrases in retrieved hyperlinks as potential parameters: True or False
• respParamJSON † – If the MIME sort of the response incorporates JSON, whether or not so as to add JSON Key values as potential parameters: True or False
• respParamJSVars † – Whether or not javascript variables set with var, let or const are added as potential parameters: True or False
• respParamXML † – If the MIME sort of the response incorporates XML, whether or not so as to add XML attributes values as potential parameters: True or False
• respParamInputField † – If the MIME sort of the response incorporates HTML, whether or not so as to add NAME and ID attributes of any INPUT fields as potential parameters: True or False
• respParamMetaName † – If the MIME sort of the response incorporates HTML, whether or not so as to add NAME attributes of any META tags as potential parameters: True or False

† IF THESE ARE NOT FOUND IN THE CONFIG FILE THEY WILL DEFAULT TO True

Examples

Discover Hyperlinks from a selected goal – Primary

python3 xnLinkFinder.py -i goal.com

Discover Hyperlinks from a selected goal – Detailed

Ideally, present scope prefix (-sp) with the first area (together with schema), and a scope filter (-sf) to filter the outcomes solely to related domains (this generally is a file or in scope domains). Additionally, you possibly can go cookies and buyer headers to make sure you discover hyperlinks solely obtainable to authorised customers. Specifying the Person Agent (-u desktop cell) will first seek for all hyperlinks utilizing desktop Person Brokers, after which strive once more utilizing cell person brokers. There may very well be particular endpoints which are associated to the person agent given. Giving a depth worth (-d) will maintain sending request to hyperlinks discovered on the earlier depth search to seek out extra hyperlinks.

python3 xnLinkFinder.py -i goal.com -sp target_prefix.txt -sf target_scope.txt -spo -inc -vv -H 'Authorization: Bearer XXXXXXXXXXXXXX' -c 'SessionId=MYSESSIONID' -u desktop cell -d 10

Discover Hyperlinks from an inventory of URLs – Primary

You probably have a file of JS file URLs for instance, you possibly can search for hyperlinks in these:

python3 xnLinkFinder.py -i target_js.txt

Discover Hyperlinks from a recordsdata in a listing – Primary

You probably have a recordsdata, e.g. JS recordsdata, HTTP responses, and so forth. you possibly can search for hyperlinks in these:

python3 xnLinkFinder.py -i ~/Instruments/waymore/outcomes/goal.com

NOTE: Sub directories are additionally checked. The -mfs choice might be specified to skip recordsdata over a sure dimension.

Discover Hyperlinks from a Burp mission – Primary

In Burp, choose the gadgets you need to search by highlighting the scope for instance, proper clicking and deciding on the Save chosen gadgets. Be certain that the choice base64-encode requests and responses choice is checked earlier than saving. To get all hyperlinks from the file (even with HUGE recordsdata, you can get all of the hyperlinks):

python3 xnLinkFinder.py -i target_burp.xml

NOTE: xnLinkFinder makes the idea that if the primary line of the file handed with -i begins with <?xml then you are attempting to course of a Burp file.

Discover Hyperlinks from a Burp mission – Detailed

Ideally, present scope prefix (-sp) with the first area (together with schema), and a scope filter (-sf) to filter the outcomes solely to related domains.

python3 xnLinkFinder.py -i target_burp.xml -o target_burp.txt -sp https://www.goal.com -sf goal.* -ow -spo -inc -vv

Discover Hyperlinks from an OWASP ZAP mission – Primary

In ZAP, choose the gadgets you need to search by highlighting the Historical past for instance, clicking menu Report and deciding on Export Messages to File.... It will allow you to save an ASCII textual content file of all requests and responses you need to search. To get all hyperlinks from the file (even with HUGE recordsdata, you can get all of the hyperlinks):

python3 xnLinkFinder.py -i target_zap.txt

NOTE: xnLinkFinder makes the idea that if the primary line of the file handed with -i is within the format ==== 99 ========== for instance, then you are attempting to course of an OWASP ZAP ASCII textual content file.

Piping to different Instruments

You’ll be able to pipe xnLinkFinder to different instruments. Any errors are despatched to stderr and any hyperlinks discovered are despatched to stdout. The output file continues to be created along with the hyperlinks being piped to the following program. Nevertheless, potential parameters aren’t piped to the following program, however they’re nonetheless written to file. For instance:

python3 xnLinkFinder.py -i redbull.com -sp https://redbull.com -sf rebbull.* -d 3 | unfurl keys | type -u

You can too go the enter via stdin as a substitute of -i.

cat redbull_subs.txt | python3 xnLinkFinder.py -sp https://redbull.com -sf rebbull.* -d 3

NOTE: You’ll be able to’t pipe in a Burp or ZAP file, these have to be handed utilizing -i.

Suggestions and Notes