EndExt

EndExt एक .go टूल है जो JS फ़ाइलों से सभी संभावित एंडपॉइंट्स निकालने के लिए है।

विचार

जब आप उदाहरण के लिए waybackurls से सभी JS फ़ाइलों को क्रॉल करते हैं, या अपने लक्ष्य वेबसाइट के होम सोर्स पेज से JS फ़ाइलों के URL भी इकट्ठा करते हैं.. यदि वेबसाइट API सिस्टम का उपयोग कर रही है और आप JS फ़ाइलों में सभी एंडपॉइंट्स खोजना चाहते हैं, क्योंकि आपको यहाँ या वहाँ कुछ छिपा मिल सकता है.. इसीलिए मैंने यह टूल बनाया.. मैं इसे JS फ़ाइलों के URL देता हूँ.. यह मेरे लिए प्रस्तुत JS फ़ाइलों में सभी संभावित एंडपॉइंट्स या URLs या पथों को पकड़ता है..

स्थापना

बस go स्थापित करने की आवश्यकता है, चलाएँ:

▶ brew install go
▶ git clone https://github.com/SirBugs/endext.git

या https://go.dev/dl/ से डाउनलोड करें

ध्यान दें कि आपको regex.tmp फ़ाइल डाउनलोड करनी होगी और उसमें अपनी कस्टम regex डालनी होगी जो आपके सामने आने वाली JS फ़ाइल पर निर्भर करती है!

डिफ़ॉल्ट Regex पैटर्न:

"\?(.*?)"
"\/(.*?)"
'\/(.*?)'
`\/(.*?)`
this\.fetch\(this\.url\("([^"]+)"\)

उपयोग:

▶ go run main.go -l js_files_urls.txt

[ 0 ] https://dashboard.target.com/assets/index-8d4703d5.js : "?o.credentials="
[ 1 ] https://dashboard.target.com/assets/index-8d4703d5.js : "?id="
[ 2 ] https://dashboard.target.com/assets/index-8d4703d5.js : "?ddforward="
[ 3 ] https://dashboard.target.com/assets/index-8d4703d5.js : "?i="
[ 4 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/api/v2/"
[ 5 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/target-0b66e97b.png"
[ 6 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/welcome-f0600742.png"
[ 7 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/[email protected]"
[ 8 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/screenshot-063bd7f1.png"
[ 9 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/[email protected]"
[ 10 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/ACHAuthorizationTemplate-b7991176.pdf"
[ 11 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/CommercialDepositAccountAgreement_March2023-34034815.pdf"
[ 12 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/target-Prohibited-Categories-7a050116.pdf"
[ 13 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/csv-a3fb6a60.svg"
[ 14 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/gif-2e1908c8.svg"
[ 15 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/html-2dcba250.svg"
[ 16 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/jpeg-2ad1d5df.svg"
[ 17 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/jpg-4e59c322.svg"
[ 18 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/json-3f816b3b.svg"
[ 19 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/pdf-e4bef26d.svg"
[ 20 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/png-478fed1d.svg"
[ 21 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/tiff-c76a207d.svg"
[ 22 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/txt-803993e5.svg"
[ 23 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/unknown-6debfec0.svg"
[ 24 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/zip-e303efb1.svg"
[ 25 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/pattern-5243e697.svg"
[ 26 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/app"
[ 27 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/api-keys"
[ 28 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/bank-accounts"
[ 29 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/counterparties"
[ 30 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/entities/person"
[ 31 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/entities/business"
[ 32 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/entities"
[ 33 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/events"
[ 34 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/events/webhook"
[ 35 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/invites"
[ 36 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/invites/resend_email"
[ 37 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/plaid/auth/oauth2/temp-code"
[ 38 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/simulate/receive-ach-credit"
[ 39 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/simulate/receive-ach-debit"
[ 40 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/simulate/transfers/ach/settle"
[ 41 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/simulate/receive-wire"
[ 42 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/simulate/receive-international-wire"
[ 43 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/simulate/transfers/wire/settle"
[ 44 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/transfers/ach"
[ 45 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/transfers/ach/stop-payments"
[ 46 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/transfers/ach/returns"
[ 47 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/transfers/book"
[ 48 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/transfers/checks/issue"
[ 49 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/transfers"
[ 50 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/transfers/wire"
[ 51 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/dashboard-users"
[ 52 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/password_reset_request"
[ 53 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/login"
[ 54 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/dashboard-users/settings"
[ 55 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/mfa/verify"
[ 56 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/logout"
[ 57 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/self"
[ 58 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/dashboard-users/password"
[ 59 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/mfa/setup"
[ 60 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/mfa/resend"

एक लाइन कमांड:

▶ echo 'target.com' | waybackurls | grep "\.js" > js_files.txt; go run main.go -l js_files.txt

// आप Gau, HaKrawler, Katana, आदि का उपयोग कर सकते हैं...

विकल्प:

  -l string
    	.txt फ़ाइल जिसमें JavaScript फ़ाइल URL हों
  -o string
    	एंडपॉइंट्स को सहेजने के लिए आउटपुट
  -s	साइलेंस बिच
  -u string
    	एकल JavaScript फ़ाइल का सीधा URL

अद्यतन:

(0.0.2) :: प्रकाशित
(0.0.3) :: डुप्लिकेट हटाना
(0.0.4) :: RegexGrep इसके साथ this.fetch(this.url("X") && URLs फ़िल्टरिंग कार्यक्षमता को छोटा करना
(0.0.5) :: एकल url के लिए फ़्लैग -u या urls सूची -l && public the urls के लिए फ़्लैग -p && output के लिए फ़्लैग -o
(0.0.6) :: पूरी संरचना को सुधारना, silence फ़्लैग जोड़ना और इसे तेज़ बनाना
(0.0.7) :: regex.tmp file not found की त्रुटि को फ़ाइल पथ को स्थिर करके ठीक करना

श्रेय:

यह टूल Golang में लिखा गया है, मिस्र में पूरे प्यार के साथ! <3

Twitter@SirBagoza , Github@SirBugs

endext

सबसे लोकप्रिय