dwisiswant0 / wadl-dumper Goto Github PK

View Code? Open in Web Editor NEW

85.0 2.0 15.0 44 KB

Dump all available paths and/or endpoints on WADL file.

License: MIT License

Go 100.00%

go golang xml xml-parser wadl bugbounty bugbountytips bugbounty-tool

wadl-dumper's Introduction

wadl-dumper

Dump all available paths and/ endpoints on WADL file.

Installation

Download a prebuilt binary from releases page, unpack and run! or
If you have go1.13+ compiler installed: go get github.com/dwisiswant0/wadl-dumper

Usage

It's very simple!

$ wadl-dumper -i https://domain.tld/application.wadl

Flags

Usage:
  wadl-dumper -i http://domain.tld/application.wadl [options...]
  wadl-dumper -i /path/to/wadl.xml --show-base -r "-alert(1)-"

Options:
  -i, --input <URL/FILE>         URL/path to WADL file
  -b, --show-base                Add base URL to paths
  -r, --replace <string>         Replace all placeholder with given value
  -h, --help                     Show its help text

Show Base URL

By default, wadl-dumper doesn't add a base URL to each paths, use -b/--show-base flag to add it.

$ wadl-dumper -i https://beacon.netflix.com/application.wadl -b
http://nmtracking.netflix.com/users/customerevents
http://nmtracking.netflix.com/nm
http://nmtracking.netflix.com/tracking
http://nmtracking.netflix.com/itracking
http://nmtracking.netflix.com/track
http://nmtracking.netflix.com/{subResources:.*}
http://nmtracking.netflix.com/users
http://nmtracking.netflix.com/presentationtracking

Replace Placeholder

You can also replace all {placeholder} values in each paths with -r/--replace flag.

$ wadl-dumper -i https://tw.bid.yahoo.com/api/application.wadl -b -r "-alert(1)-"
http://auc-papi.bid.yahoo.com:4080/api/api/-alert(1)-
http://auc-papi.bid.yahoo.com:4080/api/campaigns/-alert(1)-
http://auc-papi.bid.yahoo.com:4080/api/escrows/-alert(1)-
http://auc-papi.bid.yahoo.com:4080/api/p2ppListing/-alert(1)-
http://auc-papi.bid.yahoo.com:4080/api/channels/-alert(1)-
http://auc-papi.bid.yahoo.com:4080/api/channels/-alert(1)-/readInfo
http://auc-papi.bid.yahoo.com:4080/api/channels/-alert(1)-/members
http://auc-papi.bid.yahoo.com:4080/api/users/-alert(1)-/qnas
http://auc-papi.bid.yahoo.com:4080/api/users/-alert(1)-
http://auc-papi.bid.yahoo.com:4080/api/users/-alert(1)-/ranking
http://auc-papi.bid.yahoo.com:4080/api/users/-alert(1)-/rating
...

Supporting Materials/References

Leveraging Exposed WADL XML in Burp Suite

License

wadl-dumper is released under MIT. See LICENSE.

wadl-dumper's People

Contributors

Stargazers

Watchers

Forkers

pikpikcu affilares hunter0x8 polling-repo-continua osamahamad 5l1v3r1 bbhunter slooppe cowlingbanana hackingbharat ateeshrajak fdlucifer silentsoul04 madusec gprime31

wadl-dumper's Issues

panic: runtime error: invalid memory address or nil pointer dereference

hello.thanks for this project... i have this error with "go1.15 linux/amd64"


cyberthereaper@cyberthereaper:~$    wadl-dumper -i https://example.com

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x28 pc=0x6aa7aa]

goroutine 1 [running]:
github.com/antchfx/xmlquery.(*Node).InnerText.func1(0xc00018e360, 0x0)
        /home/cyberthereaper/go/src/github.com/antchfx/xmlquery/node.go:50 +0x2a
github.com/antchfx/xmlquery.(*Node).InnerText(0x0, 0x73cb53, 0x14)
        /home/cyberthereaper/go/src/github.com/antchfx/xmlquery/node.go:62 +0x87
main.main()
        /home/cyberthereaper/go/src/github.com/dwisiswant0/wadl-dumper/main.go:100 +0xe5

I also tried on different server and got the same error with go1.15.2 linux/amd64

Error! Can't parse WADL file.

Describe the bug

This bugs occurs when the target has insecure SSL

To Reproduce

wadl-dumper -i "https://customerevents.us-east-1.internal.dradis.netflix.com/application.wadl?detail=true" -b

Expected behavior

Output all the possible paths in the wadl directory

Screenshots

Environment (please complete the following information):

OS: Ubuntu 20.04
OS version: [uname -a]
wadl-dumper Version:

Additional context
Add any other context about the problem here. Full output log is probably a helpful thing to add here.

工具有问题，工具就是单纯的解析url然后提取出url，并没有把url进行组合。而实际上如果要正确访问目标，需要将url进行组合才能访问。