diff --git a/README.md b/README.md index 67c0d49..623d17b 100644 --- a/README.md +++ b/README.md @@ -26,6 +26,10 @@ I will use http.txt to see if there is any content there. Sometimes I may use it recursively. +## hae.txt + +A bunch of regular expressions I use with the [HaE extension](https://github.com/gh0stkey/HaE). This may be a bit redudant now with the release of [Burp BChecks](https://github.com/PortSwigger/BChecks). The regular expressions themselves are still useful. + ## objects.txt I generally use this if I find some sort of API/RPC type endpoint like /api to discover the resources that the API can interact with. diff --git a/hae.txt b/hae.txt new file mode 100644 index 0000000..528d209 --- /dev/null +++ b/hae.txt @@ -0,0 +1,11 @@ +(graphql\?\w+|\s*\"variables\"\:\{) +operation\:\"query\"\,\w+\:\{\w+\:\"Name\"\,\w+\:\"(\w+)\"\} +(api|\/api\/|\/v[1-10]\/|\/\d*\.\d*\/) +\_\_schema\s+\{ +kind\:\"Operation\"\,name\:\"(\w+)\" +query\s+(\b[A-Z]\w+)\( +graphql\/.*(\b[A-Z]\w+)\s+ +\"queryName\"\:\"(\w+)\" +\"operationName\"\:\"(\w+)\" +\/\:type\/ +query\s+(\b[A-Z]\w+)