Skip to content

Google Web Toolkit · passage 2 of 2

Methodology

Text · Google Web Toolkit/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

* Enumerate the methods of a remote application via it's bootstrap file and create a local backup of the code (selects permutation at random): ```ps1 ./gwtmap.py -u http://10.10.10.10/olympian/olympian.nocache.js --backup ``` * Enumerate the methods of a remote application via a specific code permutation ```ps1 ./gwtmap.py -u http://10.10.10.10/olympian/C39AB19B83398A76A21E0CD04EC9B14C.cache.js ``` * Enumerate the methods whilst routing traffic through an HTTP proxy: ```ps1 ./gwtmap.py -u http://10.10.10.10/olympian/olympian.nocache.js --backup -p http://127.0.0.1:8080 ``` * Enumerate the methods of a local copy (a file) of any given permutation: ```ps1 ./gwtmap.py -F test_data/olympian/C39AB19B83398A76A21E0CD04EC9B14C.cache.js ``` * Filter output to a specific service or method: ```ps1 ./gwtmap.py -u http://10.10.10.10/olympian/olympian.nocache.js --filter AuthenticationService.login ``` * Generate RPC payloads for all methods of the filtered service, with coloured output ```ps1 ./gwtmap.py -u http://10.10.10.10/olympian/olympian.nocache.js --filter AuthenticationService --rpc --color ``` * Automatically test (probe) the generate RPC request for the filtered service method ```ps1 ./gwtmap.py -u http://10.10.10.10/olympian/olympian.nocache.js --filter AuthenticationService.login --rpc --probe ./gwtmap.py -u http://10.10.10.10/olympian/olympian.nocache.js --filter TestService.testDetails --rpc --probe ```

Source: Google Web Toolkit/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 2 is a mark on the map. Named now: 1 to 2, reading order first.

  1. Google Web Toolkit§ 1text · README.md
  2. Methodology§ 2text · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.