Skip to content
KitploitKITPLOIT
工具博客
提交
工具博客
提交

黑客、渗透测试和网络安全工具，武装您的安全武器库！

Kitploit 是一个黑客、网络安全和渗透测试工具的目录。发现最新的项目更新，查找漏洞、分析系统、自动化测试并加强你的安全。

··订阅源·联系·隐私·© 2026 Kitploit

工具目录

分类

查看所有分类
Loading categories
endext — 从JavaScript文件中提取所有可能的端点、URL和路径，使用可自定义的正则表达式模式，用于Web应用程序侦察和API发现。 | Kitploit
工具/GitHubGitHub/sirbugs/endext
侦察信息收集Web安全网络爬虫
GitHubsirbugs/endext

endext

从JavaScript文件中提取所有可能的端点、URL和路径，使用可自定义的正则表达式模式，用于Web应用程序侦察和API发现。

查看仓库
2192762年前Kitploit 审核通过

最受欢迎

查看全部 →

发现我们社区最常用的工具。

探索所有工具

浏览我们的工具集合

查看所有工具 →
分享

EndExt

EndExt 是一个 .go 工具，用于从 JS 文件中提取所有可能的端点

想法

当你从 waybackruls 等工具爬取所有 JS 文件，或者从目标网站首页源码中收集 JS 文件的 URL 时…… 如果网站使用了 API 系统，并且你想在 JS 文件中查找所有端点，因为你可能会在这里或那里找到一些隐藏的内容…… 这就是我制作这个工具的原因。我给它 JS 文件的 URL，它会为我抓取提交的 JS 文件中所有可能的端点、URL 或路径。

安装

只需安装 go，然后运行：

root@kitploit:~
▶ brew install go
▶ git clone https://github.com/SirBugs/endext.git

或从 https://go.dev/dl/ 下载

注意：你需要下载 regex.tmp 文件，并根据你面对的 JS 文件，将自定义的正则表达式放入其中！

默认正则表达式模式：

root@kitploit:~
"\?(.*?)"
"\/(.*?)"
'\/(.*?)'
`\/(.*?)`
this\.fetch\(this\.url\("([^"]+)"\)

用法：

root@kitploit:~
▶ go run main.go -l js_files_urls.txt

[ 0 ] https://dashboard.target.com/assets/index-8d4703d5.js : "?o.credentials="
[ 1 ] https://dashboard.target.com/assets/index-8d4703d5.js : "?id="
[ 2 ] https://dashboard.target.com/assets/index-8d4703d5.js : "?ddforward="
[ 3 ] https://dashboard.target.com/assets/index-8d4703d5.js : "?i="
[ 4 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/api/v2/"
[ 5 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/target-0b66e97b.png"
[ 6 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/welcome-f0600742.png"
[ 7 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/[email protected]"
[ 8 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/screenshot-063bd7f1.png"
[ 9 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/[email protected]"
[ 10 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/ACHAuthorizationTemplate-b7991176.pdf"
[ 11 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/CommercialDepositAccountAgreement_March2023-34034815.pdf"
[ 12 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/target-Prohibited-Categories-7a050116.pdf"
[ 13 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/csv-a3fb6a60.svg"
[ 14 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/gif-2e1908c8.svg"
[ 15 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/html-2dcba250.svg"
[ 16 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/jpeg-2ad1d5df.svg"
[ 17 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/jpg-4e59c322.svg"
[ 18 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/json-3f816b3b.svg"
[ 19 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/pdf-e4bef26d.svg"
[ 20 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/png-478fed1d.svg"
[ 21 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/tiff-c76a207d.svg"
[ 22 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/txt-803993e5.svg"
[ 23 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/unknown-6debfec0.svg"
[ 24 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/zip-e303efb1.svg"
[ 25 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/assets/pattern-5243e697.svg"
[ 26 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/app"
[ 27 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/api-keys"
[ 28 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/bank-accounts"
[ 29 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/counterparties"
[ 30 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/entities/person"
[ 31 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/entities/business"
[ 32 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/entities"
[ 33 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/events"
[ 34 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/events/webhook"
[ 35 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/invites"
[ 36 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/invites/resend_email"
[ 37 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/plaid/auth/oauth2/temp-code"
[ 38 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/simulate/receive-ach-credit"
[ 39 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/simulate/receive-ach-debit"
[ 40 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/simulate/transfers/ach/settle"
[ 41 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/simulate/receive-wire"
[ 42 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/simulate/receive-international-wire"
[ 43 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/simulate/transfers/wire/settle"
[ 44 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/transfers/ach"
[ 45 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/transfers/ach/stop-payments"
[ 46 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/transfers/ach/returns"
[ 47 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/transfers/book"
[ 48 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/transfers/checks/issue"
[ 49 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/transfers"
[ 50 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/transfers/wire"
[ 51 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/dashboard-users"
[ 52 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/password_reset_request"
[ 53 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/login"
[ 54 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/dashboard-users/settings"
[ 55 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/mfa/verify"
[ 56 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/logout"
[ 57 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/self"
[ 58 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/dashboard-users/password"
[ 59 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/mfa/setup"
[ 60 ] https://dashboard.target.com/assets/index-8d4703d5.js : "/dashboard/mfa/resend"

一行命令：

root@kitploit:~
▶ echo 'target.com' | waybackurls | grep "\.js" > js_files.txt; go run main.go -l js_files.txt

// 你也可以使用 Gau、HaKrawler、Katana 等工具……

选项：

root@kitploit:~
  -l string
    	.txt 文件，包含 JavaScript 文件 URL
  -o string
    	输出保存端点
  -s	静默模式
  -u string
    	单个 JavaScript 文件的直接 URL

更新日志：

  • (0.0.2) :: 发布
  • (0.0.3) :: 去除重复项
  • (0.0.4) :: 使用 this.fetch(this.url("X") 进行正则匹配，并缩短 URL 过滤功能
  • (0.0.5) :: 增加单个 URL 标志 -u 或 URL 列表标志 -l；增加公开 URL 标志 -p；增加输出标志 -o
  • (0.0.6) :: 重构整个结构，添加静默标志并提高速度
  • (0.0.7) :: 修复 regex.tmp file not found 错误，将文件路径改为常量

感谢：

本工具用 Golang 编写，在埃及用满满的爱打造！<3

Twitter@SirBagoza ，Github@SirBugs

下载工具