A replacement of qsreplace, accepts URLs as standard input, replaces all query string values with user-supplied values and stdout.

Last update: Dec 31, 2022

Overview

Bhedak

A replacement of qsreplace, accepts URLs as standard input, replaces all query string values with user-supplied values and stdout. Works on every OS. Made with python

Installation

$ wget -O bhedak https://raw.githubusercontent.com/R0X4R/bhedak/main/bhedak.py -q && chmod +x bhedak && mv bhedak /usr/bin/

Usage

For linux, unix and debian based systems

$ waybackurls target.tld | bhedak "payload"

For windows based systems

cmd> type urls.txt | python bhedak.py "payload"

If no payload passed

$ waybackurls subdomain.target.tld | bhedak

http://subdomain.target.tld/comment.php?pid=FUZZ&user=FUZZ
http://subdomain.target.tld/disclaimer.php=FUZZ
http://subdomain.target.tld/hpp/index.php?pp=FUZZ
http://subdomain.target.tld/hpp/?pp=FUZZ&user=FUZZ

Example input file

$ waybackurls subdomain.target.tld | tee -a urls

http://subdomain.target.tld/comment.php?pid=username&user=1
http://subdomain.target.tld/disclaimer.php=1
http://subdomain.target.tld/hpp/index.php?pp=12
http://subdomain.target.tld/hpp/?pp=12&user=5

Replace query string values

$ cat urls | bhedak "FUZZ"

http://subdomain.target.tld/comment.php?pid=FUZZ&user=FUZZ
http://subdomain.target.tld/disclaimer.php=FUZZ
http://subdomain.target.tld/hpp/index.php?pp=FUZZ
http://subdomain.target.tld/hpp/?pp=FUZZ&user=FUZZ

Replace query string with custom payloads

$ cat urls | bhedak "\">
      
      "
      
      

http://subdomain.target.tld/comment.php?pid=%22%3E%3Csvg%2Fonload%3Dalert%281%29%3E%2A%27%2F---%2B%7B%7B7%2A7%7D%7D&user=%22%3E%3Csvg%2Fonload%3Dalert%281%29%3E%2A%27%2F---%2B%7B%7B7%2A7%7D%7D
http://subdomain.target.tld/disclaimer.php=%22%3E%3Csvg%2Fonload%3Dalert%281%29%3E%2A%27%2F---%2B%7B%7B7%2A7%7D%7D
http://subdomain.target.tld/hpp/index.php?pp=%22%3E%3Csvg%2Fonload%3Dalert%281%29%3E%2A%27%2F---%2B%7B%7B7%2A7%7D%7D
http://subdomain.target.tld/hpp/?pp=%22%3E%3Csvg%2Fonload%3Dalert%281%29%3E%2A%27%2F---%2B%7B%7B7%2A7%7D%7D&user=%22%3E%3Csvg%2Fonload%3Dalert%281%29%3E%2A%27%2F---%2B%7B%7B7%2A7%7D%7D

Remove duplicate urls

$ cat urls | bhedak "FUZZ" | sort -u

http://subdomain.target.tld/comment.php?pid=FUZZ&user=FUZZ
http://subdomain.target.tld/disclaimer.php=FUZZ
http://subdomain.target.tld/hpp/index.php?pp=FUZZ
http://subdomain.target.tld/hpp/?pp=FUZZ&user=FUZZ

Comparsion

$ echo "http://fakedomain.com/fakefile.jsp;jsessionid=2ed4262dbe69850d25bc7c6424ba59db?hardwareid=14&tarifid=9998" | qsreplace "FUZZ"
http://fakedomain.com/fakefile.jsp;jsessionid=2ed4262dbe69850d25bc7c6424ba59db?hardwareid=FUZZ&tarifid=FUZZ

$ echo "http://fakedomain.com/fakefile.jsp;jsessionid=2ed4262dbe69850d25bc7c6424ba59db?hardwareid=14&tarifid=9998" | bhedak "FUZZ"
http://fakedomain.com/fakefile.jsp;jsessionid=FUZZ?hardwareid=FUZZ&tarifid=FUZZ

Donate

If this tool helped you or you like my work

Thanks to @tomnomnom for making an amazing tool called qsreplace, from using qsreplace I got idea to make bhedak

Appointment Tracker that allows user to input client information and update if needed.

Appointment-Tracker Appointment Tracker allows an assigned admin to input client information regarding their appointment and their appointment time. T

1 Nov 30, 2021

A simple calculator that can add, subtract, multiply or divide depending upon the input from the user

Calculator A simple calculator that can add, subtract, multiply or divide depending upon the input from the user. In this example, we should have the

1 Dec 27, 2021

We want to check several batch of web URLs (1~100 K) and find the phishing website/URL among them.

We want to check several batch of web URLs (1~100 K) and find the phishing website/URL among them. This module is designed to do the URL/web attestation by using the API from NUS-Phishperida-Project.

3 Dec 28, 2022

Import modules and files straight from URLs.

Import Python code from modules straight from the internet.

2 Jan 15, 2022

Python screenshot library, replacement for the Pillow ImageGrab module on Linux.

tldr: Use Pillow The pyscreenshot module is obsolete in most cases. It was created because PIL ImageGrab module worked on Windows only, but now Linux

455 Dec 24, 2022

Insert a Spotify Playlist, Get a list of YouTube URLs from it.

spotbee This is a module that spits out YouTube URLs from Spotify Playlist URLs Why use this? It is asynchronous which makes it compatible to use with

10 Apr 6, 2022

🔩 Like builtins, but boltons. 250+ constructs, recipes, and snippets which extend (and rely on nothing but) the Python standard library. Nothing like Michael Bolton.

Boltons boltons should be builtins. Boltons is a set of over 230 BSD-licensed, pure-Python utilities in the same spirit as — and yet conspicuously mis

6k Jan 6, 2023

🔩 Like builtins, but boltons. 250+ constructs, recipes, and snippets which extend (and rely on nothing but) the Python standard library. Nothing like Michael Bolton.

Boltons boltons should be builtins. Boltons is a set of over 230 BSD-licensed, pure-Python utilities in the same spirit as — and yet conspicuously mis

5.4k Feb 20, 2021

Modeval (or Modular Eval) is a modular and secure string evaluation library that can be used to create custom parsers or interpreters.

modeval Modeval (or Modular Eval) is a modular and secure string evaluation library that can be used to create custom parsers or interpreters. Basic U

2 Jan 1, 2022

Releases(v2.0.0)

v2.0.0(Dec 12, 2021)
A replacement of qsreplace, accepts URLs as standard input, replaces all query string values with user-supplied values and stdout. Works on every OS. Made with python

What's Changed

Update to v2.0.0 by @R0X4R in https://github.com/R0X4R/bhedak/pull/1

fixed some-issues by @R0X4R in https://github.com/R0X4R/bhedak/pull/3

New Contributors

@R0X4R made their first contribution in https://github.com/R0X4R/bhedak/pull/1

Full Changelog: https://github.com/R0X4R/bhedak/compare/v1.0...v2.0.0
Source code(tar.gz)
Source code(zip)
bhedak_x86_64_linux(1.69 MB)
bhedak_x86_64_windows.exe(1.97 MB)
v1.0(Nov 23, 2021)

A replacement of qsreplace, accepts URLs as standard input, replaces all query string values with user-supplied values and stdout. Only for linux, unix and debian based systems.
Source code(tar.gz)
Source code(zip)

A replacement of qsreplace, accepts URLs as standard input, replaces all query string values with user-supplied values and stdout.

Related tags

Overview

Bhedak

Installation

Usage

Donate

You might also like...

Appointment Tracker that allows user to input client information and update if needed.

A simple calculator that can add, subtract, multiply or divide depending upon the input from the user

We want to check several batch of web URLs (1~100 K) and find the phishing website/URL among them.

Import modules and files straight from URLs.

Python screenshot library, replacement for the Pillow ImageGrab module on Linux.

Insert a Spotify Playlist, Get a list of YouTube URLs from it.

🔩 Like builtins, but boltons. 250+ constructs, recipes, and snippets which extend (and rely on nothing but) the Python standard library. Nothing like Michael Bolton.

🔩 Like builtins, but boltons. 250+ constructs, recipes, and snippets which extend (and rely on nothing but) the Python standard library. Nothing like Michael Bolton.

Modeval (or Modular Eval) is a modular and secure string evaluation library that can be used to create custom parsers or interpreters.

Releases(v2.0.0)

v2.0.0(Dec 12, 2021)

What's Changed

New Contributors

v1.0(Nov 23, 2021)

Owner

Eshan Singh

A collection of tips for using MISP.

Just some information about this nerd.

These are After Effects and Python files that were made in the process of creating the video for the contest.

Identify and annotate mutations from genome editing assays.

A Python application that helps users determine their calorie intake, and automatically generates customized weekly meal and workout plans based on metrics computed using their physical parameters

A simple, light-weight and highly maintainable online judge system for secondary education

Powering up Apache JMeter with Streamlit and opening the door for machine learning.

Object-oriented programming exercise session held in Petnica.

Block when attacker want to bypass the limit of request

A simple website-based resource monitor for slurm system.

Generic NDJSON importer for hashlookup server

A Blender addon for VSE that auto-adjusts video strip's length, if speed effect is applied.

Repository voor verhalen over de woningbouw-opgave in Nederland

一个IDA脚本，可以检测出哈希算法（无论是否魔改常数）并生成frida hook 代码。

Some basic sorting algos

Library for Memory Trace Statistics in Python

📽 Streamlit application powered by a PyScaffold project setup

This is sample project needed for security course to connect web service to database

TinyBar - Tiny MacOS menu bar utility to track price dynamics for assets on TinyMan.org

Python program that generates random user from API