– If the MIME type of the response contains HTML, whether to add NAME attributes of any META tags as potential parameters: Trueor False† IF THESE ARE NOT FOUND IN THE CONFIG FILE THEY WILL DEFAULT TO TrueExamplesFind Links from a specific target – Basicpython3 xnLinkFinder.py -i target.com Find Links from a specific target – DetailedIdeally, provide scope prefix (-sp) with the primary domain (including schema), and a scope filter (-sf) to filter the results only to relevant domains (this can be a file or in scope domains). Also, you can pass cookies and customer headers to ensure you find links only available to authorised users. Specifying the User Agent (-u desktop mobile) will first search for all links using desktop User Agents, and then try again using mobile user agents. There could be specific endpoints that are related to the user agent given. Giving a depth value (-d) will keep sending request to links found on the previous depth search to find more links.
python3 xnLinkFinder.py -i target.com -sp target_prefix.txt -sf target_scope.txt -spo -inc -vv -H 'Authorization: Bearer XXXXXXXXXXXXXX' -c 'SessionId=MYSESSIONID' -u desktop mobile -d 10 Find Links from a list of URLs – BasicIf you have a file of JS file URLs for example, you can look for links in those:
python3 xnLinkFinder.py -i target_js.txt Find Links from a files in a directory – BasicIf you have a files, e.g. JS files, HTTP responses, etc. you can look for links in those:
python3 xnLinkFinder.py -i ~/Tools/waymore/results/target.com
NOTE: Sub directories are also checked. The -mfsoption can be specified to skip files over a certain size. Find Links from a Burp project – BasicIn Burp, select the items you want to search by highlighting the scope for example, right clicking and selecting the Save selected items. Ensure that the option base64-encode requests and responsesoption is checked before saving. To get all links from the file (even with HUGE files, you’ll be able to get all the links):
python3 xnLinkFinder.py -i target_burp.xml
NOTE: xnLinkFinder makes the assumption that if the first line of the file passed with -istarts with then you are trying to process a Burp file. Find Links from a Burp project – DetailedIdeally, provide scope prefix (-sp) with the primary domain (including schema), and a scope filter (-sf) to filter the results only to relevant domains.
python3 xnLinkFinder.py -i target_burp.xml -o target_burp.txt -sp https://www.target.com -sf target.* -ow -spo -inc -vv Find Links from an OWASP ZAP project – BasicIn ZAP, select the items you want to search by highlighting the History for example, clicking menu Reportand selecting Export Messages to File.... This will let you save an ASCII text file of all requests and responses you want to search. To get all links from the file (even with HUGE files, you’ll be able to get all the links):
python3 xnLinkFinder.py -i target_zap.txt
NOTE: xnLinkFinder makes the assumption that if the first line of the file passed with -iis in the format ==== 99 ==========for example, then you are trying to process an OWASP ZAP ASCII text file. Find Links from a Waymore results directoryThe waymore tool can be used to get URLs from various third party APIs, and also download archived responses from archive.org (Wayback Machine). Passing a waymore results directory to xnLinKFinder will search the contents of archived responses, and also request URLs from waymore.txtand also the archived URLs from index.txtand get more links from those responses.
python3 xnLinkFinder.py -i ~/Tools/waymore/results/target.com
NOTE: It is passed as a normal directory, but xnLinkFinder will determine it is a waymore results directory and process respectively[...]

. Piping to other ToolsYou can pipe xnLinkFinder to other tools. Any errors are sent to stderrand any links found are sent to stdout. The output file is still created in addition to the links being piped to the next program. However, potential parameters are not piped to the next program, but they are still written to file. For example:
python3 xnLinkFinder.py -i redbull.com -sp https://redbull.com -sf rebbull.* -d 3 | unfurl keys | sort -u
You can also pass the input through stdininstead of -i.
cat redbull_subs.txt | python3 xnLinkFinder.py -sp https://redbull.com -sf rebbull.* -d 3
NOTE: You can’t pipe in a Burp or ZAP file, these must be passed using -i. Recommendations and Notes* Always use the Scope Prefix argument -sp. This can be one scope domain, or a file containing multiple scope domains. Below are examples of the format used (no path should be included, and no wildcards used. Schema is optional, but will default to http): http://www.target.com https://target-payments.com https://static.target-cdn.comIf a link is found that has no domain, e.g. /path/to/example.jsthen giving passing -sp http://www.target.comwill result in teh output http://www.target.com/path/to/example.jsand if Depth (-d) is >1 then a request will be able to be made to that URL to search for more links. If a file of domains are passed using -spthen the output will include each domain followed by /path/to/example.jsand increase the chance of finding more links.
* If you use -spbut still want the original link of /path/to/example.js(without a domain) additionally returned in the output, the pass the argument -spo.
* Always use the Scope Filter argument -sf. This will ensure that only relevant domains are returned in the output, and more importantly if Depth (-d) is >1 then out of scope targets will not be searched for links or parameters. This can be one scope domain, or a file containing multiple scope domains. Below are examples of the format used (no schema or path should be included): target.* target-payments.com static.target-cdn.comTHIS IS FOR FILTERING THE LINKS DOMAIN ONLY.
* If you want to filter the final output in any way, use -ra. It’s always a good idea to use https://regex101.com/ to check your Regex expression is going to do what you expect.
* Use the -voption to have a better idea of what the tool is doing.
* If you have problems, use the -vvoption which may show errors that are occurring, which can possibly be resolved, or you can raise as an issue on github.
* Pass cookies (-c), headers (-H) and regex (-ra) values within single quotes, e.g. -ra '/api/v[0-9]\.[0-9]\*'* Set the -ooption to give a specific output file name for Links, rather than the default of output.txt. If you plan on running a large depth of searches, start with 2 with option -vto check what is being returned. Then you can increase the Depth, and the new output will be appended to the existing file, unless you pass -ow.
* Set the -opoption to give a specific output file name for Potential Parameters, rather than the default of parameters.txt. Any output will be appended to the existing file, unless you pass -ow.
* If using a high Depth (-d) be wary of some sites using dynamic links so will it will just keep finding new ones. If no new links are being found, then xnlLinkFinder will stop searching. Providing the Stop flags (s429, s403, sTO, sCE) should also be considered.
* If you are finding a large number of links (especially if the Depth (-d value is high), and have limited resources, the p[...]

rogram will stop when it reaches the memory Threshold (-m) value and end gracefully with data intact before getting killed.
* If you decide to cancel xnLinkFinder (using Ctrl-C) in the middle of running, be patient and any gathered data will be saved before ending gracefully.
* Using the -origoption will show the URL where the link was found. This can mean you have duplicate links in the output if the same link was found on multiple sources, but it will suffixed with the origin URL in square brackets.
* When making requests, xnLinkFinder will use a random User-Agent from the current group, which defaults to desktop. If you have a target that could have different links for different user agent groups, the specify -u desktop mobilefor example (separate with a space). The mobileuser agent option is an combination of mobile-apple, mobile-androidand mobile-windows.
* When -ihas been set to a directory, the contents of the files in the root of that directory will be searched for links. Files in sub-directories are not searched. Any files that are over the size set by -mfs(default: 500 MB) will be skipped.
* When using the -replay-proxyoption, sometimes requests can take longer. If you start seeing more Request Timeouterrors (you’ll see errors if you use -vor -vvoptions) then consider using -tto raise the timeout limit.
* If you know a target will only have ASCII characters in links and parameters then consider passing -ascii-only. This can eliminate a number of false positives that can sometimes get returned from binary data.
* If you pass a waymore results directory, it is worth passing the -d/--depth argument to search any extra links found from URL requests and also the -u/--user-agent if you think there could be different content found, e.g. -u desktop mobile. IssuesIf you come across any problems at all, or have ideas for improvements, please feel free to raise an issue on Github. If there is a problem, it will be useful if you can provide the exact command you ran and a detailed description of the problem. If possible, run with -vvto reproduce the problem and let me know about any error messages that are given. Example outputActive link finding for a domain:
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiBGhUl6D8WxGj4n0FSWMiG_1wzbagi5fYy1muwgdWmUooF_yIbz18xyV4I55xWahOFY2Rb_MBaywUJB6sOyMrM-UPD_tfBoYun25YvDAMfpKQO4JoE3At5lB4d26yp3aNX8DDUZufKBfka4bqRLE9zA6ktixZJciQxYAiEHDwihtlSTEaelSOYM_eo/s1407/xnLinkFinder1.png https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghHSS2gKAG1zjbMZY_kqgQlzWwDYTZqSzBOfNudqz8OCpVidYHsdSb4J18ZbF_eAECW98U8nCfbB09QnAss74jj3VnhIhC5vGvoADaynuno9iewas7wx7J5mDXLfvmjArAN6Ca95NPJfFmnyqgVw6ueoY6G2s3IX_rQPaS33JPLgu-wrcouVRD4U7g/s1409/xnLinkFinder2.png
Piped input and output:
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGdk9vW5SLLaO9L9n2W1RptevN16iHWk2u_XTjMNt4cNRwJ9S2saDdgX11Tk4fwm1NgJ4ecsIarC64fsgWElYn3aMmQZfG3TQMRCDWra6BG79NIKYJsBpYPl0DVhVme3b2X-fy00FCaDInQc22ItKUGq9rcUZbZAki9n-uEqfQ4G60MHEsN8pIXxs-/s1724/xnLinkFinder3.png Click Here To Download

Dark Reading: Attacks/Breaches
MSP Market Opportunity Report Finds Cybersecurity as Primary Growth Driver as SMBs Lack Resources to Develop Security Program In-House

New report shows 75% of MSPs will invest in security threat intelligence services in the next 12 months to help businesses combat increased threats.

Dark Reading: Attacks/Breaches
Security Leaders are Calling for Industry to Take Action and Programmatically Improve Secure Coding Education

.

Dark Reading: Attacks/Breaches
SealPath Data Classification Powered by Getvisibility Applies Artificial Intelligence to Improve Accuracy and Efficiency of Data Labelling and Protection

.

Dark Reading: Attacks/Breaches
Study Finds Significant Correlation Between BitSight Analytics and Cybersecurity Incidents

The Marsh McLennan Cyber Risk Analytics Center conducted independent analysis of BitSight's Security Rating and risk vectors and cybersecurity incident data.

Dark Reading: Attacks/Breaches
Cybersecurity Risks & Stats This Spooky Season

From ransomware to remote workers to cyber-extortion gangs to Fred in shipping who clicks on the wrong link, cybersecurity concerns can keep you awake this season and all seasons.

Dark Reading: Attacks/Breaches
Dealers Report Dramatic Increase in Identity Fraud: Most Lack Effective Protection

Identity fraud has increased at 84% of dealerships, with 60% losing three or more vehicles in the last year.

Dark Reading: Attacks/Breaches
As Vulnerabilities Soar, Slim.AI Launches 'Container Intelligence' to Give In-Depth Analysis on Hundreds of Popular Container Images

Free service provides insights developers need to systematically identify and reduce container vulnerabilities.

Dark Reading: Attacks/Breaches
Duality Launches First Ever Enterprise-Ready Privacy-Enhanced Data Collaboration Platform

Platform delivers unmatched performance, broad analysis capabilities, and governance across any data, geo, or cloud.

Dark Reading: Attacks/Breaches
Financial Services Firms Operating Under False Sense of Security

Trend Micro research finds most are over-confident about ability to withstand ransomware.

Dark Reading: Attacks/Breaches
Palo Alto Networks NextWave Program Provides the Threat Response Community With XDR for Incident Response Fueled by MSSP Demand

Driving better security outcomes for customers through partner-delivered incident response services built on Cortex XDR.

Dark Reading: Attacks/Breaches
US Employees Feel Little Concern for Data Theft at Work, New Research Reveals

.

Dark Reading: Attacks/Breaches
Akamai Announces Next Generation DDoS Defense Platform

Upgrade boosts Akamai's dedicated mitigation capacity by 100% and enhances attack fighting capabilities for increasingly sophisticated DDoS threats.

Dark Reading: Attacks/Breaches
Spyderbat Announces Open Source Program for Cloud Native Visibility and Security

Open source tools by Spyderbat address the needs of Platform Engineering and DevOps teams by delivering new insights to workload activities and behaviors.

Dark Reading: Attacks/Breaches
Illusive's Identity Threat Detection and Response (ITDR) Solution Protects Privileged Accounts

New release extends best-in-class coverage of identity vulnerability discovery and remediation.

Dark Reading: Attacks/Breaches
AwareID™ Offers Lightning-Fast Identity Verification, Multi-Factor Authentication and Multi-Modal Biometrics in a Single Low-Code platform

.

Hacking on Medium
HTTP request smuggling Explained and Exploited Part 0x3

https://cdn-images-1.medium.com/max/1170/0*sVhSM5o18Oi0cK0H.jpg
Hi! My name is Hashar Mujahid, and today we will continue to discuss what HTTP request smuggling vulnerabilities are and how we can…

Continue reading on InfoSec Write-ups »