loading
Loading content
loading
Utilities
Replace every query-string value across a URL list.
overview
qsreplace sits between a crawler and an injection tester. It rewrites every query value to a marker or payload you supply.
Use it when crawled URLs need payload injection and shape dedup before dalfox, kxss, or sqlmap runs.
Feed url-list plus replace-query-param; -a appends onto existing values instead of overwriting. Output is a file of rewritten URLs.
use cases
Replace each query-string value with an XSS or SQLi probe so crawled URLs arrive at the testing stage already carrying the payload.
Collapse URLs that differ only in their values down to the unique parameter sets, so a fuzzing run tests each shape once instead of thousands of near-duplicates.
Use -a to add a marker to current parameter values rather than overwriting them, preserving context the application expects.
Emit FUZZ (or a tool-specific marker) into every value, then hand the list to wfuzz, ffuf, or an XSS scanner.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url-list | FILE | · | File of URLs to rewrite (stdin equivalent on the CLI). |
| replace-query-param | STRING | · | User-supplied value that replaces every query-string value. |
| append-to-query-param | STRING | -a | Append to query-string values instead of replacing them (-a). |
| each-param-combination | BOOLEAN | -a | Only output each parameter combination. |
Showing key inputs. qsreplace exposes 4 inputs in total.
example
# replace every query value with an XSS probecat urls.txt | qsreplace '"><script>alert(1)</script>'https://example.com/search?q="><script>alert(1)</script>&lang="><script>alert(1)</script>https://example.com/product?id="><script>alert(1)</script>https://example.com/redirect?next="><script>alert(1)</script>https://app.example.com/api?user="><script>alert(1)</script>&ref="><script>alert(1)</script>https://example.com/login?returnUrl="><script>alert(1)</script>https://example.com/blog?page="><script>alert(1)</script>&sort="><script>alert(1)</script>guidance
Use qsreplace to prepare crawled URLs for injection testing by swapping every parameter value for a payload and collapsing duplicate shapes. It rewrites URLs; it does not test them. Feed output to dalfox, kxss, or sqlmap.
Decomposes URLs into parts. Use it to extract or analyse components; qsreplace rewrites values.
Greps URLs for interesting patterns. Run it before qsreplace to select URLs worth injecting.
Appends only unique lines. Complements qsreplace dedup when merging URL sets from multiple sources.
faq
related
Spider a URL and return a wordlist for password crackers.
Wordlist and mined-word subdomain permutation.
Import, export, and upsert workflow data against an Airtable base.
Decode Android APK files into smali sources and resources.
Check a file's values against conditions and exit with a matching code.
Authenticated Route53 hosted-zone inventory.
Crawled URLs feed qsreplace, which injects a payload into every parameter and deduplicates them for dalfox to test before the findings land as output.
Facts on this page come from the live Trickest tool library.