URL Parser and Query Analyzer - SimeonOnSecurity
NOTE: This tool runs entirely in your browser with client-side JavaScript. URLs are parsed locally and are never transmitted, logged, or stored. That matters when the URL carries a token or a signed parameter.
Components
| Enter a URL to break it into its parts. |
Query Parameters, Decoded
| Parameters appear here once a URL is parsed. |
What to Look For
- Credentials in the URL. A username or password in the authority ends up in proxy logs, browser history and referrer headers. It is a finding, not a convenience.
- Encoded characters in the path. Percent encoding hides
../sequences from a reader, so the decoded form is worth a second look. - Unexpected ports. Port 8443 or 8080 on an endpoint that should be 443 often means a different service than the one you expected.
- Token-like parameters. Anything named token, key, secret, sig or auth in a query string is recorded wherever the URL is.
Sponsored by The Cyber Sentinels Club
