Requirements • Installation • Tool options • Usage • license
x9 is a fuzzing tool to identify potentially vulnerable parameters in web application which can be used for mass hunting
- Python3
git clone https://github.com/mha4065/x9.gitpip3 install -r requirements.txtchmod +x x9.py./x9.py -h
- You can also download the binary file of the tool from the releases and move it to
/usr/local/bin/path x9 -h
-uor--url: Single URL to edit-lor--list: List of URLs to edit-por--parameters: Parameter wordlist to fuzz-cor--chunk: Chunk to fuzz the parameters. (default: 15)-vor--value: Value for parameters to fuzz-vfor--value_file: List of Values for parameters to fuzz-gsor--generate_strategy: Select the mode strategy from the available choice (default all)normal: Remove all parameters and put the wordlistcombine: Pitchfork combine on the existing parametersignore: Don't touch the URL and put the wordlistall: All in one method-vsor--value_strategy: Select the mode strategy from the available choices:replace: Replace the value with gathered valuesuffix: Append the value to the end of the parameters-oor--output: Output results-sor--silent: Silent mode-hor--help: Display help message
Single URL with all methods
./x9.py -u "https://domain.tld/?param1=value1¶m2=value2" -v '"mhainjected"' -p parameters.txt -c 20
output
https://domain.tld/?hidden_param1=%22mhainjected%22&hidden_param2=%22mhainjected%22
https://domain.tld/?param1=value1¶m2=%22mhainjected%22&hidden_param1=%22mhainjected%22&hidden_param2=%22mhainjected%22
https://domain.tld/?param1=%22mhainjected%22¶m2=value2&hidden_param1=%22mhainjected%22&hidden_param2=%22mhainjected%22
https://domain.tld/?param1=value1¶m2=value2%22mhainjected%22&hidden_param1=%22mhainjected%22&hidden_param2=%22mhainjected%22
https://domain.tld/?param1=value1%22mhainjected%22¶m2=value2&hidden_param1=%22mhainjected%22&hidden_param2=%22mhainjected%22
https://domain.tld/?param1=value1¶m2=value2&hidden_param1=%22mhainjected%22&hidden_param2=%22mhainjected%22
List of URLs with all methods
./x9.py -l urls.txt -v '"mhainjected"' -p parameters.txt -c 20
Multiple value as payload
./x9.py -u "https://domain.tld/?param1=value1¶m2=value2" -v '"mhainjected"' -v "'mhainjected'" -v '<b/mhainjected' -p parameters.txt -c 20
List of values as payload
./x9.py -u "https://domain.tld/?param1=value1¶m2=value2" -vf values.txt -p parameters.txt -c 20
Normal generation strategy
./x9.py -u "https://domain.tld/?param1=value1¶m2=value2" -v '"mhainjected"' -p parameters.txt -c 20 -gs normal
output
https://domain.tld/?hidden_param1=%22mhainjected%22&hidden_param2=%22mhainjected%22
Combine generation strategy with suffix value strategy
./x9.py -u "https://domain.tld/?param1=value1¶m2=value2" -v '"mhainjected"' -p parameters.txt -c 20 -gs combine -vs suffix
output
https://domain.tld/?param1=value1%22mhainjected%22¶m2=value2&hidden_param1=%22mhainjected%22&hidden_param2=%22mhainjected%22
https://domain.tld/?param1=value1¶m2=value2%22mhainjected%22&hidden_param1=%22mhainjected%22&hidden_param2=%22mhainjected%22
Combine generation strategy with replace value strategy
./x9.py -u "https://domain.tld/?param1=value1¶m2=value2" -v '"mhainjected"' -p parameters.txt -c 20 -gs combine -vs replace
output
https://domain.tld/?param1=%22mhainjected%22¶m2=value2&hidden_param1=%22mhainjected%22&hidden_param2=%22mhainjected%22
https://domain.tld/?param1=value1¶m2=%22mhainjected%22&hidden_param1=%22mhainjected%22&hidden_param2=%22mhainjected%22
Ignore generation strategy
./x9.py -u "https://domain.tld/?param1=value1¶m2=value2" -v '"mhainjected"' -p parameters.txt -c 20 -gs ignore
output
https://domain.tld/?param1=value1¶m2=value2&hidden_param1=%22mhainjected%22&hidden_param2=%22mhainjected%22
Run the tool in silent mode
./x9.py -u "https://domain.tld/?param1=value1¶m2=value2" -v '"mhainjected"' -p parameters.txt -c 20 -s
Write output to a file
./x9.py -u "https://domain.tld/?param1=value1¶m2=value2" -v '"mhainjected"' -p parameters.txt -c 20 -o output.txt
You can also pipe your URL(s) to tools
echo "https://domain.tld/?param1=value1¶m2=value2" | x9 -v '"mhainjected"' -p parameters.txt -c 20
cat urls.txt | x9 -v '"mhainjected"' -p parameters.txt -c 20
This project is licensed under the MIT license. See the LICENSE file for details.