GTGalaxi - Quick Lookup Plugin for PowerToys Run (Wox)
Quick Lookup Plugin for PowerToys Run
This plugin for PowerToys Run allows you to quickly search for an IP address, domain name, hash or any other data points in a list of Cyber Security tools. It's perfect for security analysts, penetration testers, or anyone else who needs to quickly lookup information when investigating artifacts or alerts.
Installation
To install the plugin:
- Navigate to your Powertoys Run Plugin folder
- For machine wide install of PowerToys:
C:\Program Files\PowerToys\modules\launcher\Plugins
- For per user install of PowerToys:
C:\Users\<yourusername>\AppData\Local\PowerToys\modules\launcher\Plugins
- For machine wide install of PowerToys:
- Create a new folder called QuickLookup
- Extract the contents of the zip file into the folder you just created
- Restart PowerToys and the plugin should be loaded under the Run tool settings and work when promted with
ql
Usage
To use the plugin, simply open PowerToys Run by pressing Alt+Space and type the activation command ql
followed by the tool category and the data you want to lookup.
The plugin will open the data searched in a new tab in your default browser for each tool registered with that category.
Default Tools
This plugin currently comes default with the following tools:
- Shodan - IP Lookup
- GreyNoise - IP Lookup
- Spur - IP Lookup
- VirusTotal - IP, Domain & Hash Lookup
- Censys - IP & Domain Lookup
- CriminalIP - IP & Domain Lookup
- Whois - Whois Lookup
- EasyCounter - Whois Lookup
- Whoisology - Whois Lookup
Configuration
NOTE: Prior to version 1.3.0
tools.conf
was the default configuration file used.The plugin will now automatically convert the
tools.conf
list totools.json
if it does not already exist in JSON form and will then default to using that instead.
The legacy config file will remain however will not be used and will not be included in future builds starting from v1.3.0
By default, the plugin will use the precofigured tools listed above. You can modify these settings by editing the tools.json
file in the plugin folder.
The format for the configuration file follows the below standard:
{
"Name": "VirusTotal",
"URL": "https://www.virustotal.com/gui/search/{0}",
"Categories": [ "ip", "domain", "hash"],
"Enabled": true
}
In the URL, {0}
will be replace with the search input. As such, only sites that work based on URL data (GET Requests) are supported for now.
For example, https://www.virustotal.com/gui/search/{0}
would become https://www.virustotal.com/gui/search/1.1.1.1
License
This plugin is licensed under the MIT License. Feel free to use, modify, and distribute the code as you see fit. If you make any improvements or bugfixes, please consider contributing back to the project by opening a pull request.