Utilities
Keep injection-shaped URLs from a recon dump
Named JSON patterns over grep for recon URL triage.
overview
What gf does
gf is the triage slot after URL collection. Crawlers and archive scrapers dump huge lists; gf keeps only lines that match a named pattern class such as XSS, SSRF, open redirect, or SQL injection.
Patterns live in plain gf-json files. You select a pattern instead of retyping a long regex. Teams share the same library across targets so triage stays consistent.
Trickest runs gf as a managed Utilities node: input file and gf-json in, file and folder of matches out. Chain it after a collector such as gau and before a fuzzer or scanner.
source github.com/tomnomnom/gf
use cases
Where gf fits
Triage a wall of collected URLs
Run gf over the output of a URL scraper to keep only lines that match a chosen pattern, cutting a list of tens of thousands down to the handful worth a closer look.
Surface injection-prone parameters
Apply patterns for XSS, SSRF, open redirect, or SQL injection to flag URLs whose parameters match those shapes, then hand the survivors to a fuzzing stage.
Reuse a shared pattern library
Supply a curated JSON pattern file so the same triage logic runs across every target in a workflow instead of living in one person's shell history.
Pre-filter before heavier scanning
Drop URLs that cannot match a risk class so a scanner or active tester only spends time on parameters that already look interesting.
reference
gf inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input | FILE | · | Input file |
| gf-json | FILE | · | Name of JSON file |
Showing key inputs. gf exposes 2 inputs in total.
example
Run gf
# gf: apply xss.json pattern to URLs collected for example.comcat urls.txt | gf xss# Trickest node equivalent: input=urls.txt, gf-json=xss.jsonhttps://api.example.com/search?q=testhttps://app.example.com/redirect?url=https://example.comhttps://staging.example.com/page?id=1https://www.example.com/login?next=/dashboardhttps://dev.example.com/proxy?target=http://example.nethttps://mail.example.com/view?file=report.pdfhttps://cdn.example.com/asset?path=/static/app.jsguidance
Choosing gf
Use gf when a recon stage already produced a large URL list and you need only lines matching a known-risky pattern. It filters; it does not collect or scan. Run after a URL source and before active testing. Prefer plain grep only when you need a one-off regex outside a saved pattern library.
gau
Collects URLs from archives. It produces the list gf then filters, so they pair rather than compete.
qsreplace
Rewrites query-string values on URLs. Useful right after gf to template the candidates it surfaces.
grep
The underlying matcher. gf saves and names the patterns so you do not retype them.
faq
gf questions
related
More Utilities tools
cewl
Spider a URL and return a wordlist for password crackers.
dnsgen
Wordlist and mined-word subdomain permutation.
pup
CSS selectors over HTML, the jq counterpart for markup.
unfurl
Extract chosen URL parts from stdin into clean line lists.
whisper
Speech to txt, vtt, srt, and json from an audio file or folder.
youtube-transcript
Public caption tracks to transcript.txt and results.jsonl.
Run gf yourself
A target feeds gau, which collects URLs from archives, then gf filters them against a pattern and writes the matching candidates as a queryable output.
Facts on this page come from the live Trickest tool library.