diff --git a/README.md b/README.md index 34807bf..030d527 100644 --- a/README.md +++ b/README.md @@ -42,6 +42,7 @@ Short Form | Long Form | Description -r | --regex | RegEx for filtering purposes against found endpoints (e.g. ^/api/) -d | --domain | Toggle to use when analyzing an entire domain. Enumerates over all found JS files. -b | --burp | Toggle to use when inputting a Burp 'Save selected' file containing multiple JS files +-H | --header | Add header for request. You can add multiple headers. e.g. -H "Authorization: Bearer " -H "X-Api-Key: key" -c | --cookies | Add cookies to the request -h | --help | show the help message and exit @@ -67,6 +68,10 @@ Short Form | Long Form | Description `python linkfinder.py -i 'Desktop/*.js' -r ^/api/ -o results.html` +* Using custom header like bearer token for authenticaton: + +`python linkfinder.py -i https://example.com/1.js -H "Authorization: Bearer "` + ## Docker * Build the Docker image: diff --git a/linkfinder.py b/linkfinder.py index 6675322..936eda0 100755 --- a/linkfinder.py +++ b/linkfinder.py @@ -116,7 +116,7 @@ def parser_input(input): be found (maybe you forgot to add http/https).")] -def send_request(url): +def send_request(url, custom_headers): ''' Send requests with Requests ''' @@ -130,6 +130,9 @@ def send_request(url): q.add_header('Accept-Encoding', 'gzip') q.add_header('Cookie', args.cookies) + for key, value in custom_headers.items(): + q.add_header(key, value) + try: sslcontext = ssl.create_default_context() response = urlopen(q, timeout=args.timeout, context=sslcontext) @@ -306,6 +309,9 @@ def check_url(url): parser.add_argument("-b", "--burp", help="", action="store_true") + parser.add_argument('-H', '--header', + help='Add header for request. You can add multiple headers. \ne.g. -H "Authorization: Bearer " -H "X-Api-Key: key"' + action='append') parser.add_argument("-c", "--cookies", help="Add cookies for authenticated JS files", action="store", default="") @@ -325,12 +331,18 @@ def check_url(url): # Convert input to URLs or JS files urls = parser_input(args.input) + custom_headers = {} + if args.header: + for header in args.header: + key, value = header.split(':', 1) + custom_headers[key.strip()] = value.strip() + # Convert URLs to JS output = '' for url in urls: if not args.burp: try: - file = send_request(url) + file = send_request(url, custom_headers) except Exception as e: parser_error("invalid input defined or SSL error: %s" % e) else: