loading
Loading content
loading
Utilities
Named JSON patterns over grep for recon URL triage.
overview
gf is the triage slot after URL collection. Crawlers and archive scrapers dump huge lists; gf keeps only lines that match a named pattern class such as XSS, SSRF, open redirect, or SQL injection.
Patterns live in plain gf-json files. You select a pattern instead of retyping a long regex. Teams share the same library across targets so triage stays consistent.
Trickest runs gf as a managed Utilities node: input file and gf-json in, file and folder of matches out. Chain it after a collector such as gau and before a fuzzer or scanner.
source github.com/tomnomnom/gf
use cases
Run gf over the output of a URL scraper to keep only lines that match a chosen pattern, cutting a list of tens of thousands down to the handful worth a closer look.
Apply patterns for XSS, SSRF, open redirect, or SQL injection to flag URLs whose parameters match those shapes, then hand the survivors to a fuzzing stage.
Supply a curated JSON pattern file so the same triage logic runs across every target in a workflow instead of living in one person's shell history.
Drop URLs that cannot match a risk class so a scanner or active tester only spends time on parameters that already look interesting.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| input | FILE | · | Input file |
| gf-json | FILE | · | Name of JSON file |
Showing key inputs. gf exposes 2 inputs in total.
example
# gf: apply xss.json pattern to URLs collected for example.comcat urls.txt | gf xss# Trickest node equivalent: input=urls.txt, gf-json=xss.jsonhttps://api.example.com/search?q=testhttps://app.example.com/redirect?url=https://example.comhttps://staging.example.com/page?id=1https://www.example.com/login?next=/dashboardhttps://dev.example.com/proxy?target=http://example.nethttps://mail.example.com/view?file=report.pdfhttps://cdn.example.com/asset?path=/static/app.jsguidance
Use gf when a recon stage already produced a large URL list and you need only lines matching a known-risky pattern. It filters; it does not collect or scan. Run after a URL source and before active testing. Prefer plain grep only when you need a one-off regex outside a saved pattern library.
Collects URLs from archives. It produces the list gf then filters, so they pair rather than compete.
Rewrites query-string values on URLs. Useful right after gf to template the candidates it surfaces.
The underlying matcher. gf saves and names the patterns so you do not retype them.
faq
related
Spider a URL and return a wordlist for password crackers.
Wordlist and mined-word subdomain permutation.
Import, export, and upsert workflow data against an Airtable base.
Decode Android APK files into smali sources and resources.
Check a file's values against conditions and exit with a matching code.
Authenticated Route53 hosted-zone inventory.
A target feeds gau, which collects URLs from archives, then gf filters them against a pattern and writes the matching candidates as a queryable output.
Facts on this page come from the live Trickest tool library.