How to Install And Use GF and GF Patterns: Automate Finding XSS and SQLi
Disclaimer: This channel focuses on creating Educational Content only!
The purpose of this channel is only to share knowledge about ETHICAL hacking and not any illegal activities. If any illegal activities are conducted with the knowledge gained from this channel, this channel can't be held responsible.
Thank you!
Welcome to Bug Bounty Tutorials! We aim to create Free and Educational Content related to InfoSec and Bug Bounty Hunting. The main focus of this channel is to create video tutorials of tools and services which are short and most importantly, easy to follow along for beginners. This channel aims to create Beginner Friendly Content to guide the new people who are getting started off on the wrong foot in this amazing Field. Getting into Bug Bounty Hunting and Ethical Hacking can be intimidating and most people don't know where to start from because there are a ton of resources and paths available. While that is good, it is most confusing to the new players in this game!
This channel focuses on creating content related to InfoSec, Ethical Hacking, Bug Bounties, Cybersecurity, whatever you want to call it! The goal is to make this channel the resource that we would have needed when we were just starting our journey. It is a way for us to give back to the community.
Subscribe to this channel to get started on your path to Cybersecurity success on the right foot!
Gf, A tool made by @tomnomnom "is A wrapper around grep, to help you grep for things". The Github Repository for GF can be found here:
https://github.com/tomnomnom/gf
GF Patterns is an open-source project made by @1ndianl33t and this project contains custom patterns that can be used with the original GF tool to grep for patterns for common bugs like XSS, SQLi, and SSRF.
The Github repository for this can be found here:
https://github.com/1ndianl33t/Gf-Patt...
Note: You need to have GO installed correctly before you can install this tool. You can install Go on your OS here: https://golang.org/doc/install
Installation:
1) First install GF-Patterns by @1ndianl33t in the root directory-
git clone https://github.com/1ndianl33t/Gf-Patt...
2) Then install Gf by @Tomnomnom- https://github.com/tomnomnom/gf
3) go get -u github.com/tomnomnom/gf
4) This should install GF and GF Patterns correctly.
5) If you faced any errors during Installation then please comment down below.
Usage:
Configure GF to work with GF Patterns:
1)Go to the root directory
2) mkdir .gf
3) Go to /root/Gf-Patterns
4) mv *.json /root/.gf
5) Now to test if GF is working: gf -list
CONFIGURED GF CORRECTLY!
(-list)To list all of the available patterns
The most important command:
(cat urls.txt | gf "name of pattern")
This command doesn't work all that properly, it searches specific for keywords.
So it can give some invalid results too(as in the results not useful for us)
We will use some regex to use GF at it's best!
We will get the target URLs using Waybackurls, as demonstrated in our previous
video:
echo "vulnweb.com" | waybackurls -no-subs | tee urls.txt
The final command:
cat urls.txt | gf "name of pattern" | sed 's/=.*/=/' | sed 's/URL: //' | sort -u | tee output.txt
Now we got all urls with parameters that might be vulnerable to XSS, SQLi etc.
So, this way we can try different payloads and start fuzzing.
✅ Make sure to watch the entire video!!
✅Subscribe to Bug Bounty Tutorials:
https://bit.ly/subscribe-bbt-youtube
Need a VPS to hack from? We got you covered!
Get $100 credit on Digital Ocean using this link by Signing-up:
https://bit.ly/bugbountytutorials_dig...
📲 Share this video with your friends!
🔔Click the Bell Icon to Never Miss a new tutorial on Bug Bounties/Hacking/InfoSec/Cybersecurity/Ethical hacking!!
❤️Smash that Like Button!
✅ Join our Discord Server: / discord
✅ Follow us on Twitter: / bb_tutorials
✅ Follow The InfoSec Tees on Instagram: / theinfosect. .
✅ Checkout @TheInfoSecTees' online Infosec/Cybersecurity/hacking themed shirt store: https://theinfosectees.co
How you can help us out:
Like❤️ | Comment 📝 | Share 📲 | Subscribe💫
Follow our socials❗❗
Give us a shoutout on Twitter🔥
RELATED HASHTAGS:
#bugbounty #infosec #hacking #hacker #howto #cybersecurity #hackers #hack #ethicalhacking #linux #programming #kalilinux #security #technology #ethicalhacker