A replacement of qsreplace, accepts URLs as standard input, replaces all query string values with user-supplied values and stdout.

Last update: Dec 31, 2022

Overview

Bhedak

A replacement of qsreplace, accepts URLs as standard input, replaces all query string values with user-supplied values and stdout. Works on every OS. Made with python

Installation

$ wget -O bhedak https://raw.githubusercontent.com/R0X4R/bhedak/main/bhedak.py -q && chmod +x bhedak && mv bhedak /usr/bin/

Usage

For linux, unix and debian based systems

$ waybackurls target.tld | bhedak "payload"

For windows based systems

cmd> type urls.txt | python bhedak.py "payload"

If no payload passed

$ waybackurls subdomain.target.tld | bhedak

http://subdomain.target.tld/comment.php?pid=FUZZ&user=FUZZ
http://subdomain.target.tld/disclaimer.php=FUZZ
http://subdomain.target.tld/hpp/index.php?pp=FUZZ
http://subdomain.target.tld/hpp/?pp=FUZZ&user=FUZZ

Example input file

$ waybackurls subdomain.target.tld | tee -a urls

http://subdomain.target.tld/comment.php?pid=username&user=1
http://subdomain.target.tld/disclaimer.php=1
http://subdomain.target.tld/hpp/index.php?pp=12
http://subdomain.target.tld/hpp/?pp=12&user=5

Replace query string values

$ cat urls | bhedak "FUZZ"

http://subdomain.target.tld/comment.php?pid=FUZZ&user=FUZZ
http://subdomain.target.tld/disclaimer.php=FUZZ
http://subdomain.target.tld/hpp/index.php?pp=FUZZ
http://subdomain.target.tld/hpp/?pp=FUZZ&user=FUZZ

Replace query string with custom payloads

$ cat urls | bhedak "\">
      
      "
      
      

http://subdomain.target.tld/comment.php?pid=%22%3E%3Csvg%2Fonload%3Dalert%281%29%3E%2A%27%2F---%2B%7B%7B7%2A7%7D%7D&user=%22%3E%3Csvg%2Fonload%3Dalert%281%29%3E%2A%27%2F---%2B%7B%7B7%2A7%7D%7D
http://subdomain.target.tld/disclaimer.php=%22%3E%3Csvg%2Fonload%3Dalert%281%29%3E%2A%27%2F---%2B%7B%7B7%2A7%7D%7D
http://subdomain.target.tld/hpp/index.php?pp=%22%3E%3Csvg%2Fonload%3Dalert%281%29%3E%2A%27%2F---%2B%7B%7B7%2A7%7D%7D
http://subdomain.target.tld/hpp/?pp=%22%3E%3Csvg%2Fonload%3Dalert%281%29%3E%2A%27%2F---%2B%7B%7B7%2A7%7D%7D&user=%22%3E%3Csvg%2Fonload%3Dalert%281%29%3E%2A%27%2F---%2B%7B%7B7%2A7%7D%7D

Remove duplicate urls

$ cat urls | bhedak "FUZZ" | sort -u

http://subdomain.target.tld/comment.php?pid=FUZZ&user=FUZZ
http://subdomain.target.tld/disclaimer.php=FUZZ
http://subdomain.target.tld/hpp/index.php?pp=FUZZ
http://subdomain.target.tld/hpp/?pp=FUZZ&user=FUZZ

Comparsion

$ echo "http://fakedomain.com/fakefile.jsp;jsessionid=2ed4262dbe69850d25bc7c6424ba59db?hardwareid=14&tarifid=9998" | qsreplace "FUZZ"
http://fakedomain.com/fakefile.jsp;jsessionid=2ed4262dbe69850d25bc7c6424ba59db?hardwareid=FUZZ&tarifid=FUZZ

$ echo "http://fakedomain.com/fakefile.jsp;jsessionid=2ed4262dbe69850d25bc7c6424ba59db?hardwareid=14&tarifid=9998" | bhedak "FUZZ"
http://fakedomain.com/fakefile.jsp;jsessionid=FUZZ?hardwareid=FUZZ&tarifid=FUZZ

Donate

If this tool helped you or you like my work

Thanks to @tomnomnom for making an amazing tool called qsreplace, from using qsreplace I got idea to make bhedak

Appointment Tracker that allows user to input client information and update if needed.

Appointment-Tracker Appointment Tracker allows an assigned admin to input client information regarding their appointment and their appointment time. T

1 Nov 30, 2021

A simple calculator that can add, subtract, multiply or divide depending upon the input from the user

Calculator A simple calculator that can add, subtract, multiply or divide depending upon the input from the user. In this example, we should have the

1 Dec 27, 2021

We want to check several batch of web URLs (1~100 K) and find the phishing website/URL among them.

We want to check several batch of web URLs (1~100 K) and find the phishing website/URL among them. This module is designed to do the URL/web attestation by using the API from NUS-Phishperida-Project.

3 Dec 28, 2022

Import modules and files straight from URLs.

Import Python code from modules straight from the internet.

2 Jan 15, 2022

Python screenshot library, replacement for the Pillow ImageGrab module on Linux.

tldr: Use Pillow The pyscreenshot module is obsolete in most cases. It was created because PIL ImageGrab module worked on Windows only, but now Linux

455 Dec 24, 2022

Insert a Spotify Playlist, Get a list of YouTube URLs from it.

spotbee This is a module that spits out YouTube URLs from Spotify Playlist URLs Why use this? It is asynchronous which makes it compatible to use with

10 Apr 6, 2022

🔩 Like builtins, but boltons. 250+ constructs, recipes, and snippets which extend (and rely on nothing but) the Python standard library. Nothing like Michael Bolton.

Boltons boltons should be builtins. Boltons is a set of over 230 BSD-licensed, pure-Python utilities in the same spirit as — and yet conspicuously mis

6k Jan 6, 2023

🔩 Like builtins, but boltons. 250+ constructs, recipes, and snippets which extend (and rely on nothing but) the Python standard library. Nothing like Michael Bolton.

Boltons boltons should be builtins. Boltons is a set of over 230 BSD-licensed, pure-Python utilities in the same spirit as — and yet conspicuously mis

5.4k Feb 20, 2021

Modeval (or Modular Eval) is a modular and secure string evaluation library that can be used to create custom parsers or interpreters.

modeval Modeval (or Modular Eval) is a modular and secure string evaluation library that can be used to create custom parsers or interpreters. Basic U

2 Jan 1, 2022

Releases(v2.0.0)

v2.0.0(Dec 12, 2021)
A replacement of qsreplace, accepts URLs as standard input, replaces all query string values with user-supplied values and stdout. Works on every OS. Made with python

What's Changed

Update to v2.0.0 by @R0X4R in https://github.com/R0X4R/bhedak/pull/1

fixed some-issues by @R0X4R in https://github.com/R0X4R/bhedak/pull/3

New Contributors

@R0X4R made their first contribution in https://github.com/R0X4R/bhedak/pull/1

Full Changelog: https://github.com/R0X4R/bhedak/compare/v1.0...v2.0.0
Source code(tar.gz)
Source code(zip)
bhedak_x86_64_linux(1.69 MB)
bhedak_x86_64_windows.exe(1.97 MB)
v1.0(Nov 23, 2021)

A replacement of qsreplace, accepts URLs as standard input, replaces all query string values with user-supplied values and stdout. Only for linux, unix and debian based systems.
Source code(tar.gz)
Source code(zip)

A replacement of qsreplace, accepts URLs as standard input, replaces all query string values with user-supplied values and stdout.

Related tags

Overview

Bhedak

Installation

Usage

Donate

You might also like...

Appointment Tracker that allows user to input client information and update if needed.

A simple calculator that can add, subtract, multiply or divide depending upon the input from the user

We want to check several batch of web URLs (1~100 K) and find the phishing website/URL among them.

Import modules and files straight from URLs.

Python screenshot library, replacement for the Pillow ImageGrab module on Linux.

Insert a Spotify Playlist, Get a list of YouTube URLs from it.

🔩 Like builtins, but boltons. 250+ constructs, recipes, and snippets which extend (and rely on nothing but) the Python standard library. Nothing like Michael Bolton.

🔩 Like builtins, but boltons. 250+ constructs, recipes, and snippets which extend (and rely on nothing but) the Python standard library. Nothing like Michael Bolton.

Modeval (or Modular Eval) is a modular and secure string evaluation library that can be used to create custom parsers or interpreters.

Releases(v2.0.0)

v2.0.0(Dec 12, 2021)

What's Changed

New Contributors

v1.0(Nov 23, 2021)

Owner

Eshan Singh

In this repo, I will put all the code related to data science using python libraries like Numpy, Pandas, Matplotlib, Seaborn and many more.

Account Manager / Nuker with GUI.

This is an example manipulation package of for a robot manipulator based on Drake with ROS2.

Slimbook Battery 4 is the new version with new features that improves battery control and increases battery duration in laptops.

Entitlement AND Hardened Runtime Check

A python script that will automate the boring task of login to the captive portal again and again

This is a Fava extension to display a grouped portfolio view in Fava for a set of Beancount accounts.

This bot uploads telegram files to MixDrop.co,File.io.

Geodesic Dome Math

☘️ Projet Voltaire Solver in Python3

Bots in moderation and a game (for now)

Repository voor verhalen over de woningbouw-opgave in Nederland

Ultimate Microsoft Edge Uninstaller!

A tool that bootstraps your dotfiles ⚡️

Find functions without canary check (or similar)

Retrieve bank transactions and categorize for budgeting use

Binjago - Set of tools aiding in analysis of stripped Golang binaries with Binary Ninja

An app that mirrors your phone to your compute and maps controller input to the screen

Repositório do Projeto de Jogo da Resília Educação.

An AddOn storing wireguard configuration