Utilities
Inject a payload into every URL query value
Replace every query-string value across a URL list.
overview
What qsreplace does
qsreplace sits between a crawler and an injection tester. It rewrites every query value to a marker or payload you supply.
Use it when crawled URLs need payload injection and shape dedup before dalfox, kxss, or sqlmap runs.
Feed url-list plus replace-query-param; -a appends onto existing values instead of overwriting. Output is a file of rewritten URLs.
use cases
Where qsreplace fits
Inject a payload into every parameter
Replace each query-string value with an XSS or SQLi probe so crawled URLs arrive at the testing stage already carrying the payload.
Deduplicate parameter shapes
Collapse URLs that differ only in their values down to the unique parameter sets, so a fuzzing run tests each shape once instead of thousands of near-duplicates.
Append to existing values
Use -a to add a marker to current parameter values rather than overwriting them, preserving context the application expects.
Prime URLs for a fuzzer
Emit FUZZ (or a tool-specific marker) into every value, then hand the list to wfuzz, ffuf, or an XSS scanner.
reference
qsreplace inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url-list | FILE | · | File of URLs to rewrite (stdin equivalent on the CLI). |
| replace-query-param | STRING | · | User-supplied value that replaces every query-string value. |
| append-to-query-param | STRING | -a | Append to query-string values instead of replacing them (-a). |
| each-param-combination | BOOLEAN | -a | Only output each parameter combination. |
Showing key inputs. qsreplace exposes 4 inputs in total.
example
Run qsreplace
# replace every query value with an XSS probecat urls.txt | qsreplace '"><script>alert(1)</script>'https://example.com/search?q="><script>alert(1)</script>&lang="><script>alert(1)</script>https://example.com/product?id="><script>alert(1)</script>https://example.com/redirect?next="><script>alert(1)</script>https://app.example.com/api?user="><script>alert(1)</script>&ref="><script>alert(1)</script>https://example.com/login?returnUrl="><script>alert(1)</script>https://example.com/blog?page="><script>alert(1)</script>&sort="><script>alert(1)</script>guidance
Choosing qsreplace
Use qsreplace to prepare crawled URLs for injection testing by swapping every parameter value for a payload and collapsing duplicate shapes. It rewrites URLs; it does not test them. Feed output to dalfox, kxss, or sqlmap.
unfurl
Decomposes URLs into parts. Use it to extract or analyse components; qsreplace rewrites values.
gf
Greps URLs for interesting patterns. Run it before qsreplace to select URLs worth injecting.
anew
Appends only unique lines. Complements qsreplace dedup when merging URL sets from multiple sources.
workflows
Workflows using qsreplace
Find Open Redirects on a Domain
Mine a domain's archived URLs for redirect parameters, then confirm which ones send a browser to an attacker-controlled host.
Find Reflected XSS on a Domain
Collect a domain's archived URLs, keep parameters that reflect input, and fuzz each one for reflected and DOM cross-site scripting.
faq
qsreplace questions
related
More Utilities tools
cewl
Spider a URL and return a wordlist for password crackers.
dnsgen
Wordlist and mined-word subdomain permutation.
pup
CSS selectors over HTML, the jq counterpart for markup.
unfurl
Extract chosen URL parts from stdin into clean line lists.
whisper
Speech to txt, vtt, srt, and json from an audio file or folder.
youtube-transcript
Public caption tracks to transcript.txt and results.jsonl.
Run qsreplace yourself
Crawled URLs feed qsreplace, which injects a payload into every parameter and deduplicates them for dalfox to test before the findings land as output.
Facts on this page come from the live Trickest tool library.