1ndianl33t/gf-patterns

GF Paterns For (ssrf,RCE,Lfi,sqli,ssti,idor,url redirection,debug_logic, interesting Subs) parameters grep

Gf-Patterns V 1.9

GF By

A wrapper around grep, to help you grep for things

installation

Go Path Setup

If you've got Go installed and configured you can install waybackurls & Gf with:

▶ go get -u github.com/tomnomnom/waybackurls

▶ go get -u github.com/tomnomnom/gf

If you've installed using go get, you can enable auto-completion to your .bashrc like this:

▶ echo 'source $GOPATH/src/github.com/tomnomnom/gf/gf-completion.bash' >> ~/.bashrc

Note that you'll have to restart your terminal, or run source ~/.bashrc for the changes to take effect.

To get started quickly, you can copy the example pattern files to ~/.gf like this:

▶ mkdir .gf

▶ cp -r $GOPATH/src/github.com/tomnomnom/gf/examples ~/.gf

MY Gf Patterns installation

▶ git clone https://github.com/1ndianl33t/Gf-Patterns

To get started quickly, you can copy the example pattern files to ~/.gf like this:

▶ mkdir .gf

▶ mv ~/Gf-Patterns/*.json ~/.gf

Use example

▶ cat subdomains.txt | waybackurls | sort -u >> waybackdata | gf ssrf | tee -a ssfrparams.txt

▶ cat waybackdata | gf redirect | tee -a redirect.txt

Pattern Files

The pattern definitions are stored in ~/.gf as little JSON files that can be kept under version control:

gf ssrf

▶ cat ~/.gf/ssrf.json

{
    "flags": "-iE",
     "patterns": [

        "access",
        "admin",
        "dbg",
        "debug",
        "edit",
        "grant",
        "test",
        "alter",
        "clone",
        "create",
        "delete",
        "disable",
        "enable",
        "exec",
        "execute",
        "load",
        "make",
        "modify",
        "rename",
        "reset",
        "shell",
        "toggle",
        "adm",
        "root",
        "cfg",
        "dest",
        "redirect",
        "uri",
        "path",
        "continue",
        "url",
        "window",
        "next",
        "data",
        "reference",
        "site",
        "html",
        "val",
        "validate",
        "domain",
        "callback",
        "return",
        "page",
        "feed",
        "host",
        "port",
        "to",
        "out",
        "view",
        "dir",
        "show",
        "navigation",
        "open"
        
      ]
}

gf redirect

▶ cat ~/.gf/redirect

{
    "flags": "-iE",
     "patterns": [
"forward=",
"dest=",
"redirect=",
"uri=",
"path=",
"continue=",
"url=",
"window=",
"to=",
"out=",
"view=",
"dir=",
"show=",
"navigation=",
"Open=",
"file=",
"val=",
"validate=",
"domain=",
"callback=",
"return=",
"page=",
"feed=",
"host=",
"port=",
"next=",
"data=",
"reference=",
"site=",
"html="
]
}

gf rce

▶ cat ~/.gf/rce.json
{
    "flags": "-iE",
     "patterns": [
 
        "daemon",
        "upload",
        "dir",
        "execute",
        "download",
        "log",
        "ip",
        "cli",
        "cmd"
]
}

Gf idor

▶ cat ~/.gf/idor.json
{
    "flags": "-iE",
     "patterns": [

 "id",
 "user",
 "account",
 "number",
 "order",
 "no",
 "doc",
 "key",
 "email",
 "group",
 "profile",
 "edit",
 "report"
 
 ]
}

Gf Sqli

▶ cat ~/.gf/sqli.json
{
    "flags": "-iE",
     "patterns": [

         "id",
        "select",
        "report",
        "role",
        "update",
        "query",
        "user",
        "name",
        "sort",
        "where",
        "search",
        "params",
        "process",
        "row",
        "view",
        "table",
        "from",
        "sel",
        "results",
        "sleep",
        "fetch",
        "order",
        "keyword",
        "column",
        "field",
        "delete",
        "string",
        "number",
        "filter"
]
}

Gf LFI

▶ cat ~/.gf/lfi.json
{
    "flags": "-iE",
     "patterns": [

        "file",
        "document",
        "folder",
        "root",
        "path",
        "pg",
        "style",
        "pdf",
        "template",
        "php_path",
        "doc"
]
}

Gf ssti

▶ cat ~/.gf/ssti.json


{
    "flags": "-iE",
     "patterns": [
        
        "template",
        "preview",
        "id",
        "view",
        "activity",
        "name",
        "content",
        "redirect"
]
}

Gf debug_logic

▶ cat ~/.gf/debug_logic.json
{
    "flags": "-iE",
     "patterns": [

        "access",
        "admin",
        "dbg",
        "debug",
        "edit",
        "grant",
        "test",
        "alter",
        "clone",
        "create",
        "delete",
        "disable",
        "enable",
        "exec",
        "execute",
        "load",
        "make",
        "modify",
        "rename",
        "reset",
        "shell",
        "toggle",
        "adm",
        "root",
        "cfg",
        "config"
]
}

Donations

You can encourage me to contribute more to the open source with donations.

• Paypal - https://www.paypal.me/1ndianl33t

• GooglePay,Paytm -

8085778875

Credit

Bugcrowd HUNT

Contributers

@victoni added more redirect parameters

@s0meguy1 redirect & ssrf pattern Added additional filters

Contact

gf-patterns's Issues

zsh: command not found: gf

I've done everything you wrote but still I can't run it just by calling gf or gf ssrf. I've tried to download both way...

$go get -u github.com/tomnomnom/waybackurls
(NO OUTPUT)
$git clone...
$mkdir .gf
$mv ~/Gf-Patterns/*.json ~/.gf

no such pattern

When i run the tool according to the usage instruction in the READ me file i get an error message which says "no such pattern". Any help??

no such pattern ( Go tools Install as Binary )

Hello

wayback & gf tools are placed in /usr/local/bin
I mv the gf files to the same directory but got the safe error

Any solution, please ??

Thanks

how to install Patterns in windows ?

when i try this command gf -list it return nothing!! i have Windows 10, so how to install Patterns ?

Sorry .

I hear some information about X-ray tools. But I Can't see them, can u share with me?

erro em alguns arquivos json

eu baixei os seguintes arquivos json: debug_logic.json, lfi.json, redirect.json, ssrf.json, xss.json
idor.json, rce.json, sqli.json, ssti.json

porém os únicos que estão funcionando são os seguintes: redirect.json, xss.json, idor.json e sqli.json

os outros dão o seguinte erro (exemplo do debug_logic.json): pattern file '/home/kali/.gf/debug_logic.json' is malformed: invalid character '<' looking for beginning of value

será que alguém pode me ajudar?

grep error

@root:~/.gf# gf xss
grep: .: Is a directory

Not Working!

$ cat ~/oyosub.wb| gf ssrf | tee -a ssfrparams.txt

fatal: 'ssrf' does not appear to be a git repository
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

I am not able to figure out as to why I am getting "fatal" error even after having carefully repeated all the steps several times.

new tamplet not work

Brother,

First, thank you for your templates, the issue is after moving your template to ~/.gf folder, and run gf ssrf (for example), the result will be [grep: .: Is a directory]
Note: defaults(tomnomnom) it's working fine.

I am getting this trouble

/root/.zshrc:source:209: no such file or directory: /src/gf-completion.zsh...
This line is stuck in my terminal whenever i am opening my terminal this line is coming....

please make the naming convention more user friendly

The following patterns are hard to type again and again

• interestingEXT : recommending int-ext or uniq-ext
• debug_logic : recommending debug-logic since gf repo has debug-pages, php-errors etc and it will be consistent
• interestingsubs : recommending int-subs or uniq-subs
• interestingparams : recommending int-params or uniq-params

Locally I'm using uniq-ext, uniq-subs, uniq-params, etc. since uniq is short for unique, and is more easier to type than interesting and more easier to understand than int.