loading
Loading content
loading
Utilities
Persist attack-surface files in Elasticsearch and query them later.
overview
Place elasticsearch-index at the end of a recon workflow so folders of hosts, URLs, and findings land in named Elasticsearch indices.
Reach for it when grepping across run output is too slow and you need a searchable store, or when a later stage should pull prior results with --query.
Index a directory with --dir or a single file with --file. Name the index with --index, or let --auto-index derive it from the filename; map list lines with --field.
use cases
Index folders of subdomains, hosts, and findings into Elasticsearch so the whole attack surface is queryable instead of scattered across files.
Turn on auto-index so subdomains.txt lands in a subdomains index without naming each one by hand across a large workflow.
Use query mode to read back stored data so a later workflow stage can build on what earlier runs discovered.
Set --field when indexing line-oriented lists so each entry becomes a document field you can filter on later.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| dir | FOLDER | --dir | Directory with files to be indexed. |
| file | FILE | --file | Single file to be indexed. |
| index | STRING | --index | Name of the Elasticsearch index. |
| auto-index | BOOLEAN | --auto-index | Derive the index name automatically from the file name. |
| field | STRING | --field | Field name to use with list files. |
| query | STRING | --query | Query to search the index for. |
| config | FILE | --config | Path to the config YAML file. |
| file-type | STRING | --file-type | Type of the file to be indexed. |
Showing key inputs. elasticsearch-index exposes 9 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| dir | FOLDER | --dir | Directory with files to be indexed |
| file | FILE | --file | File to be indexed |
| field | STRING | --field | Field name to use with "list" files |
| index | STRING | --index | Name of the Elasticsearch index |
| query | STRING | --query | Query to search for |
| config | FILE | --config | Path to the config YAML file |
| file-type | STRING | --file-type | Type of the file to be indexed |
| auto-index | BOOLEAN | --auto-index | Automatically determine the index name based on the file name (e.g. subdomains.txt -> subdomains |
| elastic-id | BOOLEAN | --elastic-id | Use Elasticsearch's automatically-generated IDs |
example
# index a recon folder into Elasticsearch; auto-name indices from filenameselasticsearch-index --dir recon-out/ --auto-index --field host --config es-config.yaml[*] elasticsearch-index[*] Config: es-config.yaml[*] Indexing dir recon-out/[*] File subdomains.txt -> index subdomains (field=host) 128 docs[*] File live-hosts.txt -> index live-hosts (field=host) 41 docs[*] File urls.txt -> index urls (field=host) 87 docs[*] Indexed 256 documents across 3 indices[*] Sample: api.example.com, app.example.com, www.example.com[*] Doneguidance
Use elasticsearch-index to persist and search attack-surface data at the end of a workflow, or to read prior results back with --query. For lightweight stream-side deduplication rather than a searchable store, use anew.
Appends only new lines to a flat file for cheap diffing. elasticsearch-index gives you a full searchable store instead.
Pushes results into Airtable for a spreadsheet-style view. Sibling storage backend, different query model.
faq
related
Spider a URL and return a wordlist for password crackers.
Wordlist and mined-word subdomain permutation.
Import, export, and upsert workflow data against an Airtable base.
Decode Android APK files into smali sources and resources.
Check a file's values against conditions and exit with a matching code.
Authenticated Route53 hosted-zone inventory.
Recon output feeds elasticsearch_index, which loads the files into Elasticsearch and writes a searchable index downstream stages can query.
Facts on this page come from the live Trickest tool library.