# Sigurlx | A Web Application Attack Surface Mapping Tool

**URL:** <https://onehack.st/t/sigurlx-a-web-application-attack-surface-mapping-tool/170716>\
**Category:** Tools & Scripts\
**Tags:** tools, programming\
**Created:** [January 24, 2021, 4:52am UTC](https://onehack.st/t/sigurlx-a-web-application-attack-surface-mapping-tool/170716 "2021-01-24T04:52:07Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![PlayBoy83](https://onehack.st/user_avatar/onehack.st/playboy83/32/164314_2.png) [@PlayBoy83](https://onehack.st/u/PlayBoy83)\
**Post date:** [January 24, 2021, 4:52am UTC](https://onehack.st/t/sigurlx-a-web-application-attack-surface-mapping-tool/170716/1 "2021-01-24T04:52:07Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/9/7/97a7bd57020505745c53117f712b12cf11c3f06a.png)

Sigurlx a web application attack surface mapping tool, it does …:

- Categorize URLs URLs’ categories:

```auto
 > endpoint
 > js {js}
 > style {css}
 > data {json|xml|csv}
 > archive {zip|tar|tar.gz}
 > doc {pdf|xlsx|doc|docx|txt}
 > media {jpg|jpeg|png|ico|svg|gif|webp|mp3|mp4|woff|woff2|ttf|eot|tif|tiff}

```

- Next, probe HTTP requests to the URLs for `status_code`, `content_type`, e.t.c
- Next, for every URL of category `endpoint` with a query:
  - Probe for commonly vulnerable parameters (inspired by [Somdev Sangwan](https://github.com/s0md3v)‘s [Parth](https://github.com/s0md3v/Parth)).
  - Probe for reflected parameters (inspired by [Tom Hudson](https://github.com/tomnomnom)‘s [kxss](https://github.com/tomnomnom/hacks/tree/master/kxss)).

**Usage**

To display help message for sigurlx use the `-h` flag:

```auto
$ sigurlx -h

     _ _      
 ___(_)__ _ _ _ _ __| |___
/ __| |/ _` | | | | '__ | / /
__ | (_| | |_| | | | |> < 
| ___/_|__ , |__,_|_| |_/_/_ v2.1.0
       |___/

USAGE:
  sigurlx [OPTIONS]

GENERAL OPTIONS:
  -iL input urls list (use `-iL -` to read from stdin)
  -threads number concurrent threads (default: 20)
  -update-params update params file

HTTP OPTIONS:
  -delay delay between requests (default: 100ms)
  -follow-redirects follow redirects (default: false)
  -follow-host-redirects follow internal redirects i.e, same host redirects (default: false)
  -http-proxy HTTP Proxy URL
  -timeout HTTP request timeout (default: 10s)
  -UA HTTP user agent

OUTPUT OPTIONS:
  -nC no color mode
  -oJ JSON output file (default: ./sigurlx.json)
  -v verbose mode

```

**Installation**

**From Binary**

You can download the pre-built binary for your platform from this repository’s [releases](https://github.com/drsigned/sigurlx/releases/) page, extract, then move it to your `$PATH`and you’re ready to go.

**From Source**

sigurlx requires **go1.14+** to install successfully. Run the following command to get the repo

```auto
▶ go get -u github.com/drsigned/sigurlx/cmd/sigurlx

```

**From Github**

```auto
▶ git clone https://github.com/drsigned/sigurlx.git
▶ cd sigurlx/cmd/sigurlx/
▶ go build .
▶ mv sigurlx /usr/local/bin/
▶ sigurlx -h

```

**Contribution**

[Issues](https://github.com/drsigned/sigurlx/issues) and [Pull Requests](https://github.com/drsigned/sigurlx/pulls) are welcome!

## GitHub:

[https://github.com/drsigned/sigurlx](https://github.com/drsigned/sigurlx)