A CLI that tweaks and resends HTTP/S requests!
retweak can modify request URLs, methods, headers, or data and report changes in responses.
A common process in pentesting/bug bounties is web path enumeration. There are many tools to do this (e.g. dirb, dirsearch, gobuster). Note: retweak can do this but I wouldn't recommend it solely for this purpose since the aforementioned tools are better/faster.
retweak comes in handy when you want to change another part of the request (e.g. URL query parameter, request body JSON) to see if/how the response changes. Rather than manually editing and resending the request in Firefox developer tools or replaying the request with a proxy, you can programmatically tweak and resend requests with retweak.
The way it works is you define a "base request" (URL, method, headers, data), tell retweak what part of the request to "tweak", and pass a list of values. Then retweak fires off a bunch of requests. Each request is derived from the "base request" and includes one of the values in the list. Each value is injected into the request at a location you specify.
Burp Repeater has a likeminded goal of modifying and resending HTTP/S requests (and it has a UI :)). My motivation for writing retweak was to create a CLI you could easily pull off the shelf to automate this process. It's especially useful if you have tens (or hundreds) of predefined modifications you'd like to test against an endpoint. If there are other tools you think I should know about or mention here, please bring them up!
$ npm i retweak
$ retweak -h
Usage: retweak [options] [command] <url>
Options:
-V, --version output the version number
-d, --data <data/@file> request data to send
-H, --headers <headers/@file> request headers to send
-i, --ignore-headers <names/@file> don't report changes in these headers
-j, --json write JSON responses to file (only if -o)
-k, --insecure allow insecure TLS connection
-l, --list <values/@file> list of values to try
-m, --max-data <size>B/KB don't report data when it's over this size
-o, --output <file> write all responses to file
-p, --parallel send requests in parallel
-q, --quiet don't show banner and debugging info
-t, --tweak <part> part of the request to tweak ["url","method","header","data"]
-X, --method <method> request method
-h, --help output usage information
Commands:
hosts <url> test a bunch of values for the Host header
methods <url> test all HTTP methods
origins <url> test a bunch of values for the Origin header
urlencodings <url> test different URL encodings
retweak searches for an asterisk ("*") in the part of the request you'd like to tweak (unless you're tweaking the request method). Then it injects each value in -l, --list at that location and sends a request for each "injection".
If you'd like to review all responses in their entirety, you can write them to a file with the -o, --output option. The responses are plaintext by default, but you can specify -j, --json if you'd like the responses in JSON format.
The CLI adopts some options from curl that take a literal value or filename as an argument. If you'd like to pass a filename, make sure to prepend it with "@" so the CLI knows you meant to pass a filename! Note: for output the argument can only be a filename so there's no need to prepend with a "@".
retweak tries to assume sensible defaults when options aren't specified. If you provide -d, --data but don't specify -m, --method, the latter defaults to POST. Otherwise, method defaults to GET. If the method's POST, PUT, or PATCH, -t, --tweak defaults to "data", otherwise it defaults to "url".
The following sends 3 requests with different values for the query parameter, "id".
$ retweak -l "1,2,3" -t url "https://<domain>/a/b/c?id=*"
retweak has a subcommand for testing different URL encodings.
$ retweak urlencodings "https://<domain>/a/b/c?id=*"
The following sends 3 requests with different HTTP methods.
$ retweak -l "POST,PUT,PATCH" -t method <url>
retweak has a subcommand for testing all HTTP methods.
$ retweak methods <url>
The following sends 3 requests with different Host headers.
$ retweak -H "Host: *" -l "foo.com,bar.foo.com,baz.foo.com" <url>
retweak has a subcommand for injecting a bunch of values in the Host header.
$ retweak hosts <url>
Note: you can use -l, --list if you have a list of hosts, otherwise retweak will use its own.
The following sends 3 requests with different values for the "a" cookie.
$ retweak -H "Cookie: a=*;expires=sometime" -l "1,2,3" <url>
The following sends 3 requests with different values for the "foo" key in the JSON payload.
$ retweak -d '{"foo": "*"}' -l "bar,baz,bam" <url>
$ npm test
Please do!
If you find a bug, want to add a feature, or have a question, feel free to open an issue.
You're also welcome to create a pull request addressing an issue. You should push your changes to a feature branch and request merge to develop.