https://github.com/zbo14/retweak
A CLI that tweaks and resends HTTP/S requests
https://github.com/zbo14/retweak
bug-bounty cli http https pentesting
Last synced: 10 months ago
JSON representation
A CLI that tweaks and resends HTTP/S requests
- Host: GitHub
- URL: https://github.com/zbo14/retweak
- Owner: zbo14
- License: mit
- Created: 2020-04-17T21:21:43.000Z (over 5 years ago)
- Default Branch: master
- Last Pushed: 2023-01-05T11:00:23.000Z (about 3 years ago)
- Last Synced: 2025-03-19T10:09:41.420Z (10 months ago)
- Topics: bug-bounty, cli, http, https, pentesting
- Language: JavaScript
- Homepage:
- Size: 644 KB
- Stars: 1
- Watchers: 3
- Forks: 0
- Open Issues: 11
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# retweak
A CLI that tweaks and resends HTTP/S requests!
`retweak` can modify request URLs, methods, headers, or data and report changes in responses.
## But why?
A common process in pentesting/bug bounties is web path enumeration. There are many tools to do this (e.g. [dirb](http://dirb.sourceforge.net/), [dirsearch](https://github.com/maurosoria/dirsearch), [gobuster](https://github.com/OJ/gobuster)). **Note:** `retweak` can do this but I wouldn't recommend it solely for this purpose since the aforementioned tools are better/faster.
`retweak` comes in handy when you want to change *another* part of the request (e.g. URL query parameter, request body JSON) to see if/how the response changes. Rather than manually editing and resending the request in Firefox developer tools or replaying the request with a proxy, you can programmatically tweak and resend requests with `retweak`.
The way it works is you define a "base request" (URL, method, headers, data), tell `retweak` what part of the request to "tweak", and pass a list of values. Then `retweak` fires off a bunch of requests. Each request is derived from the "base request" and includes one of the values in the list. Each value is injected into the request at a location you specify.
[Burp Repeater](https://portswigger.net/burp/documentation/desktop/tools/repeater) has a likeminded goal of modifying and resending HTTP/S requests (and it has a UI :)). My motivation for writing `retweak` was to create a CLI you could easily pull off the shelf to automate this process. It's especially useful if you have tens (or hundreds) of predefined modifications you'd like to test against an endpoint. If there are other tools you think I should know about or mention here, please [bring them up](#Contributing)!
## Install
`$ npm i retweak`
## Usage
`$ retweak -h`
```
Usage: retweak [options] [command]
Options:
-V, --version output the version number
-d, --data request data to send
-H, --headers request headers to send
-i, --ignore-headers don't report changes in these headers
-j, --json write JSON responses to file (only if -o)
-k, --insecure allow insecure TLS connection
-l, --list list of values to try
-m, --max-data B/KB don't report data when it's over this size
-o, --output write all responses to file
-p, --parallel send requests in parallel
-q, --quiet don't show banner and debugging info
-t, --tweak part of the request to tweak ["url","method","header","data"]
-X, --method request method
-h, --help output usage information
Commands:
hosts test a bunch of values for the Host header
methods test all HTTP methods
origins test a bunch of values for the Origin header
urlencodings test different URL encodings
```
`retweak` searches for an asterisk ("\*") in the part of the request you'd like to tweak (unless you're tweaking the request method). Then it injects each value in `-l, --list` at that location and sends a request for each "injection".
If you'd like to review *all* responses in their entirety, you can write them to a file with the `-o, --output` option. The responses are plaintext by default, but you can specify `-j, --json` if you'd like the responses in JSON format.
The CLI adopts some options from [curl](https://curl.haxx.se/) that take a literal value *or* filename as an argument. If you'd like to pass a filename, make sure to prepend it with "@" so the CLI knows you meant to pass a filename! **Note:** for output the argument can *only* be a filename so there's no need to prepend with a "@".
`retweak` tries to assume sensible defaults when options aren't specified. If you provide `-d, --data` but don't specify `-m, --method`, the latter defaults to POST. Otherwise, method defaults to GET. If the method's POST, PUT, or PATCH, `-t, --tweak` defaults to "data", otherwise it defaults to "url".
## Examples
### URL query param
The following sends 3 requests with different values for the query parameter, "id".
```
$ retweak -l "1,2,3" -t url "https:///a/b/c?id=*"
```
`retweak` has a subcommand for testing different URL encodings.
```
$ retweak urlencodings "https:///a/b/c?id=*"
```
### HTTP method
The following sends 3 requests with different HTTP methods.
```
$ retweak -l "POST,PUT,PATCH" -t method
```
`retweak` has a subcommand for testing *all* HTTP methods.
```
$ retweak methods
```
### Header
The following sends 3 requests with different Host headers.
```
$ retweak -H "Host: *" -l "foo.com,bar.foo.com,baz.foo.com"
```
`retweak` has a subcommand for injecting a bunch of values in the Host header.
```
$ retweak hosts
```
**Note:** you can use `-l, --list` if you have a list of hosts, otherwise `retweak` will use its own.
### Cookie
The following sends 3 requests with different values for the "a" cookie.
```
$ retweak -H "Cookie: a=*;expires=sometime" -l "1,2,3"
```
### Request data
The following sends 3 requests with different values for the "foo" key in the JSON payload.
```
$ retweak -d '{"foo": "*"}' -l "bar,baz,bam"
```
## Test
`$ npm test`
## Contributing
Please do!
If you find a bug, want to add a feature, or have a question, feel free to [open an issue](https://github.com/zbo14/retweak/issues/new).
You're also welcome to [create a pull request](https://github.com/zbo14/retweak/compare/develop...) addressing an issue. You should push your changes to a feature branch and request merge to `develop`.