Skip to content
 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

109 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

paramspider

Mining URLs from dark corners of Web Archives for bug hunting/fuzzing/further probing

📖 About🏗️ Installation🌐 Sources⚙️ Configuration⛏️ Usage🚀 Examples🤝 Contributing

paramspider

About

paramspider allows you to fetch URLs related to any domain or a list of domains from multiple web archive and threat intelligence sources. It filters out "boring" URLs, allowing you to focus on the ones that matter the most.

Installation

To install paramspider, follow these steps:

git clone https://github.com/xalgord/ParamSpider
cd paramspider
pip install .

Sources

paramspider fetches URLs from 4 sources by default:

Source Description API Key
wayback Wayback Machine (web.archive.org) Not needed
commoncrawl Common Crawl (commoncrawl.org) Not needed
otx AlienVault OTX (otx.alienvault.com) Optional
urlscan URLScan.io (urlscan.io) Optional

All sources are enabled by default and work without any configuration.

Configuration

API keys are read from environment variables. This is optional — all sources work without keys, but authenticated requests get higher rate limits.

Add to your ~/.zshrc or ~/.bashrc:

export URLSCAN_API_KEY="your-urlscan-api-key"
export OTX_API_KEY="your-otx-api-key"

Then reload your shell:

source ~/.zshrc   # or source ~/.bashrc
Variable Source How to get
URLSCAN_API_KEY URLScan.io urlscan.io/user/signup
OTX_API_KEY OTX AlienVault otx.alienvault.com → Settings → API Key

Usage

paramspider -d example.com

Options

  -d, --domain            Domain name to fetch related URLs for
  -l, --list              File containing a list of domain names
  -s, --stream            Stream URLs on the terminal
  -p, --placeholder       Placeholder for parameter values (default: FUZZ)
  --proxy                 Set the proxy address for web requests
  --sources               Comma-separated list of sources to use (default: all)
  --exclude-sources       Comma-separated list of sources to exclude

Examples

  • Discover URLs for a single domain (uses all 4 sources):

    paramspider -d example.com
  • Discover URLs for multiple domains from a file:

    paramspider -l domains.txt
  • Use only specific sources:

    paramspider -d example.com --sources wayback,otx
  • Exclude slow sources:

    paramspider -d example.com --exclude-sources commoncrawl
  • Stream URLs on the terminal:

    paramspider -d example.com -s
  • Set up web request proxy:

    paramspider -d example.com --proxy '127.0.0.1:7890'
  • Custom placeholder for URL parameter values (default: "FUZZ"):

    paramspider -d example.com -p '"><h1>reflection</h1>'

Star History

Star History Chart

About

Mining URLs from dark corners of Web Archives for bug hunting/fuzzing/further probing

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages