xnlinkfinder
A python tool used to discover endpoints (and potential parameters) for a given target
Details
Category: Discovery
Publisher: trickest-mhmdiaa
Created Date: 2/3/2023
Container: quay.io/trickest/xnlinkfinder:09f3cf5-patch-6
Source URL: https://github.com/xnl-h4ck3r/xnLinkFinder
Parameters
depth
string
Command:
--depth
- The level of depth to search. For example, if a value of 2 is passed, then all links initially found will then be searched for more links (default: 1). This option is ignored for Burp files because they can be huge and consume lots of memory. It is also advisable to use the -sp (--scope-prefix) argument to ensure a request to links found without a domain can be attempted.input
string
requiredCommand:
- Input a URL or domain.config
file
Command:
--config
- Path to the YML config file. If not passed, a default 'config.yml' is used which has some excludes some words/extensions and defines some stopwords.origin
boolean
Command:
--origin
- Whether you want the origin of the link to be in the output. Displayed as LINK-URL [ORIGIN-URL] in the output (default: false)cookies
string
Command:
--cookies
- Add cookies to pass with HTTP requests. Pass in the format 'name1=value1; name2=value2;'exclude
string
Command:
--exclude
- Link exclusions in a comma separated list, e.g. careers,forumheaders
string
Command:
--headers
- Add custom headers to pass with HTTP requests. Pass in the format 'Header1: value1; Header2: value2;'include
boolean
Command:
--include
- Include input links in the output (default: false)timeout
string
Command:
--timeout
- How many seconds to wait for the server to send data before giving up (default: 10 seconds)verbose
boolean
Command:
--verbose
- Verbose outputinsecure
boolean
Command:
-insecure
- Whether TLS certificate checks should be made disabled making requests (default: false)no-banner
boolean
Command:
--no-banner
- Hides the tool banner.processes
string
Command:
--processes
- Basic multithreading is done when getting requests for a URL, or file of URLs (not a Burp file). This argument determines the number of processes (threads) used (default: 25)ascii-only
boolean
Command:
-ascii-only
- Whether links and parameters will only be added if they only contain ASCII characters (default: False). This can be useful when you know the target is likely to use ASCII characters and you also get a number of false positives from binary files for some reason.user-agent
string
Command:
--user-agent
- What User Agents to get links for, e.g. 'desktop mobile'regex-after
string
Command:
--regex-after
- RegEx for filtering purposes against found endpoints before output (e.g. /api/v[0-9].[0-9]* ). If it matches, the link is output.stop-on-403
boolean
Command:
-s403
- Stop when > 95 percent of responses return 403 Forbidden (default: false)stop-on-429
boolean
Command:
-s429
- Stop when > 95 percent of responses return 429 Too Many Requests (default: false)replay-proxy
string
Command:
-replay-proxy
- For active link finding with URL (or file of URLs), replay the requests through this proxy.scope-filter
string
requiredCommand:
--scope-filter
- Will filter output links to only include it if the domain of the link is in the scope specified.scope-prefix
string
Command:
--scope-prefix
- Any links found starting with / will be prefixed with scope domain in the output instead of the original link.very-verbose
boolean
Command:
--vverbose
- Increased verbose outputmax-file-size
string
Command:
--max-file-size
- The maximum file size (in bytes) of a file to be checked if -i is a directory. If the file size os over, it will be ignored (default: 500 MB). Setting to 0 means no files will be ignored, regardless of size.max-time-limit
string
Command:
--max-time-limit
- The maximum time limit (in minutes) to run before stopping (default: 0). If 0 is passed, there is no limit.stopwords-file
string
Command:
--stopwords-file
- A file of additional Stop Words (in addition to stopWords in the YML Config file) used to exclude words from the target specific wordlist. Stop Words are used in Natural Language Processing and different lists can be found in different libraries. You may want to add words in different languages, depending on your target.stop-on-timeout
boolean
Command:
-sTO
- Stop when > 95 percent of requests time out (default: false)wordlist-maxlen
string
Command:
--wordlist-maxlen
- The maximum length of words to add to the target specific wordlist (excluding plurals).memory-threshold
string
Command:
--memory-threshold
- The memory threshold percentage. If the machines memory goes above the threshold, the program will be stopped and ended gracefully before running out of memory (default: 95)scope-filter-file
file
Command:
--scope-filter
- Will filter output links to only include them if the domain of the link is in the scope specified.scope-prefix-file
file
Command:
--scope-prefix
- Any links found starting with / will be prefixed with scope domains in the output instead of the original link.no-wordlist-digits
boolean
Command:
--no-wordlist-digits
- Exclude any words from the target specific wordlist with numerical digits in.no-wordlist-imgalt
boolean
Command:
--no-wordlist-imgalt
- By default, any image 'alt' attributes will be processed for the target specific wordlist. If this argument is used, they will not be processed.no-wordlist-plurals
boolean
Command:
--no-wordlist-plurals
- When words are found for a target specific wordlist, by default new words are added if there is a singular word from a plural, and vice versa. If this argument is used, this process is not done.no-wordlist-comments
boolean
Command:
--no-wordlist-comments
- By default, any comments in pages will be processed for the target specific wordlist. If this argument is used, they will not be processed.no-wordlist-pathwords
boolean
Command:
--no-wordlist-pathwords
- By default, any path words found in the links will be processed for the target specific wordlist. If this argument is used, they will not be processed.scope-prefix-original
boolean
Command:
--scope-prefix-original
- If a scope-prefix is passed, then this determines whether the original link starting with / is also included in the output (default: false).no-wordlist-parameters
boolean
Command:
--no-wordlist-parameters
- By default, any parameters found in the links will be processed for the target specific wordlist. If this argument is used, they will not be processed.stop-on-connection-errors
boolean
Command:
-sCE
- Stop when > 95 percent of requests have connection errors (default: false)