qsreplace
Replace query-string values in URLs.
KaliParrotpassive
pkg: qsreplace
qsreplace swaps every parameter value in a URL list — perfect for injecting payloads before fuzzing.
Syntax
{urls} | qsreplace {value}
Example
cat urls.txt | qsreplace '"><script>'
Injects an XSS test payload into every parameter.
Advantages
- Great in fuzzing pipelines
- Tiny and fast
Disadvantages
- Utility only
- Needs a URL list
Tags
#web#fuzzing
Official docs: qsreplace ↗
Related commands
Frequently asked questions
What is qsreplace used for?
qsreplace swaps every parameter value in a URL list — perfect for injecting payloads before fuzzing.
What is an example qsreplace command?
A common example is: cat urls.txt | qsreplace '"><script>' — Injects an XSS test payload into every parameter.
Is qsreplace part of Kali Linux?
Yes. qsreplace ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install qsreplace.
What category of security tool is qsreplace?
qsreplace is a Web Application tool with a passive-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.