Utilities
Keep injection-shaped URLs from a recon dump
Named JSON patterns over grep for recon URL triage.
Go · MIT license
overview
What gf does
gf is the triage slot after URL collection. Crawlers and archive scrapers dump huge lists; gf keeps only lines that match a named pattern class such as XSS, SSRF, open redirect, or SQL injection.
Patterns live in plain gf-json files. You select a pattern instead of retyping a long regex. Teams share the same library across targets so triage stays consistent.
Trickest runs gf as a managed Utilities node: input file and gf-json in, file and folder of matches out. Chain it after a collector such as gau and before a fuzzer or scanner.
source github.com/tomnomnom/gf
use cases
Where gf fits
Triage a wall of collected URLs
Run gf over the output of a URL scraper to keep only lines that match a chosen pattern, cutting a list of tens of thousands down to the handful worth a closer look.
Surface injection-prone parameters
Apply patterns for XSS, SSRF, open redirect, or SQL injection to flag URLs whose parameters match those shapes, then hand the survivors to a fuzzing stage.
Reuse a shared pattern library
Supply a curated JSON pattern file so the same triage logic runs across every target in a workflow instead of living in one person's shell history.
Pre-filter before heavier scanning
Drop URLs that cannot match a risk class so a scanner or active tester only spends time on parameters that already look interesting.
reference
gf inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input | FILE | · | Input file |
| gf-json | FILE | · | Name of JSON file |
Showing key inputs. gf exposes 2 inputs in total.
example
Run gf
# gf: apply xss.json pattern to URLs collected for example.com
cat urls.txt | gf xss
# Trickest node equivalent: input=urls.txt, gf-json=xss.jsonhttps://api.example.com/search?q=test
https://app.example.com/redirect?url=https://example.com
https://staging.example.com/page?id=1
https://www.example.com/login?next=/dashboard
https://dev.example.com/proxy?target=http://example.net
https://mail.example.com/view?file=report.pdf
https://cdn.example.com/asset?path=/static/app.jsguidance
Choosing gf
Use gf when a recon stage already produced a large URL list and you need only lines matching a known-risky pattern. It filters; it does not collect or scan. Run after a URL source and before active testing. Prefer plain grep only when you need a one-off regex outside a saved pattern library.
gau
Collects URLs from archives. It produces the list gf then filters, so they pair rather than compete.
qsreplace
Rewrites query-string values on URLs. Useful right after gf to template the candidates it surfaces.
grep
The underlying matcher. gf saves and names the patterns so you do not retype them.
faq
gf questions
related
More Utilities tools
browser-fetch
Headless Chromium render: requested URL, final URL, status, and title next to the page.
cewl
Spider a URL and return a wordlist for password crackers.
csvkit
SQL on one CSV. The table name is the file stem.
dnsgen
Wordlist and mined-word subdomain permutation.
duckdb
In-process SQL on CSV, JSON, and Parquet. No server.
edge-tts
Microsoft Edge neural speech from text or a script file. No API key.
Run gf yourself
A target feeds gau, which collects URLs from archives, then gf filters them against a pattern and writes the matching candidates as a queryable output.
Facts on this page come from the live Trickest tool library.