How to Use URLx Queries to Hunt for Malicious URLs and Exposed Assets
Summary
A tutorial demonstrates using Hunt.io’s URLx dataset and HuntSQL queries to find potential malware payloads, phishing infrastructure, exposed sensitive files, and misconfigured assets, then enrich results with ProjectDiscovery’s httpx.
Key points
- URLx provides a searchable dataset of more than 10.6 billion structured URLs, reportedly growing by one billion URLs each month.
- The tutorial shows queries for executable payloads, disguised executables, malware staging paths, beacon-like URLs, and script-based initial access.
- Additional searches target paste-site links, open redirectors, credential-related URL parameters, exposed archives, configuration files, and potentially vulnerable API endpoints.
- URLx queries can be run through the web interface or API, and results can be exported as CSV, JSON, or NDJSON.
- The article demonstrates using httpx to check URL availability, identify technologies, inspect page details, and capture screenshots.
Article Details
- Topic
- Using URLx and HuntSQL to hunt for malicious infrastructure, payloads, phishing paths, and exposed assets across a large structured URL dataset.
Malware
AsyncRATIn a recent investigation titled "Abusing Paste.ee to Deploy XWorm and AsyncRAT", we used this same method with Hunt.io's URLx dataset alongside httpx to uncover and validate live infrastructure hosting XWorm andXWormIn a recent investigation titled "Abusing Paste.ee to Deploy XWorm and AsyncRAT", we used this same method with Hunt.io's URLx dataset alongside httpx to uncover and validate live infrastructure hosting XWorm and