• Stars
    star
    140
  • Rank 261,473 (Top 6 %)
  • Language
    Go
  • License
    MIT License
  • Created almost 3 years ago
  • Updated over 1 year ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Make URL path combinations using a wordlist

mkpath Tweet

Make URL path combinations using a wordlist

mkpath

Read a wordlist file and generate path combinations for given domain or list of domains. Input from wordlist file is lowercased and unique words are processed. Additionally, wordlist can be filtered using regex.

When you use mkpath's -l parameter, it will generate all path combinations up to the specified level, including all lower levels, using words from the wordlist. For instance, with -l 2, it will generate len(permutation_list)^2 + len(permutation_list) results, which is:

  • 30 combinations for a 5-word wordlist.
  • 10100 combinations for a 100-word wordlist.
  • 250500 combinations for a 500-word wordlist.

Installation

Binary

Binaries are available in the latest release.

Docker

docker run quay.io/trickest/mkpath

From source

go install github.com/trickest/mkpath@latest

Usage

  -d string
    	Input domain
  -df string
    	Input domain file, one domain per line
  -l int
    	URL path depth to generate (default 1) (default 1)
  -lower
    	Convert wordlist file content to lowercase (default false)
  -o string
    	Output file (optional)
  -only-dirs
    	Generate directories only, files are filtered out (default false)
  -only-files
    	Generate files only, file names are appended to given domains (default false)
  -r string
    	Regex to filter words from wordlist file
  -t int
    	Number of threads for every path depth (default 100)
  -w string
    	Wordlist file

Example

wordlist.txt
dev
prod/
admin.py
app/login.html
$ mkpath -d example.com -l 2 -w wordlist.txt
example.com/dev
example.com/prod
example.com/dev/dev
example.com/prod/dev
example.com/dev/prod
example.com/prod/prod
example.com/dev/admin.py
example.com/dev/app/login.html
example.com/prod/admin.py
example.com/prod/app/login.html
example.com/dev/dev/admin.py
example.com/dev/dev/app/login.html
example.com/prod/dev/admin.py
example.com/prod/dev/app/login.html
example.com/dev/prod/admin.py
example.com/dev/prod/app/login.html
example.com/prod/prod/admin.py
example.com/prod/prod/app/login.html

Report Bugs / Feedback

We look forward to any feedback you want to share with us or if you're stuck with a problem you can contact us at [email protected]. You can also create an Issue or pull request on the Github repository.

Where does this fit in your methodology?

Mkpath is an integral part of many workflows in the Trickest store. Sign up on trickest.com to get access to these workflows or build your own from scratch!

More Repositories

1

cve

Gather and update all available and newest CVEs with their PoC.
HTML
5,099
star
2

wordlists

Real-world infosec wordlists, updated regularly
804
star
3

inventory

Asset inventory on public bug bounty programs.
Shell
700
star
4

resolvers

The most exhaustive list of reliable DNS resolvers.
420
star
5

zip

Monitoring the internet for new .zip domains
205
star
6

mksub

Generate tens of thousands of subdomain combinations in a matter of seconds
Go
191
star
7

dsieve

Filter and enrich a list of subdomains by level
Go
145
star
8

find-gh-poc

Find CVE PoCs on GitHub
Go
110
star
9

log4j

Trickest Workflow for discovering log4j vulnerabilities and gathering the newest community payloads.
104
star
10

insiders

Archive of Potential Insider Threats
101
star
11

containers

Automated privilege escalation of the world's most popular Docker images.
Shell
62
star
12

enumerepo

List all public repositories for (valid) GitHub usernames
Go
52
star
13

safe-harbour

security.txt collection of most popular world-wide domains
50
star
14

trickest-cli

Execute Trickest workflows right from your terminal
Go
45
star
15

recon-and-vulnerability-scanner-template

Create your own recon & vulnerability scanner with Trickest and GitHub
40
star
16

cloud

Monitoring the Cloud Landscape
26
star
17

mgwls

Combine words from two wordlist files and concatenate them with an optional delimiter
Go
23
star
18

scripts

Handy scripts and one-liners to make life easier
22
star
19

elasticsearch_index

Manage attack surface data on Elasticsearch
Python
17
star
20

packages

Automated compromise detection of the world's most popular packages
13
star
21

action

Github Action for Trickest Workflows
Shell
6
star