security enabled verified low v1.0.0

gau

Get All URLs (gau) fetches known URLs from AlienVault's OTX, WayBack Machine, and other public archives for passive endpoint discovery.

📋 Live Preview

gau {target} {flags}

📎 target 📎 flags

gau {target} {flags}

Sandbox: execFile · Timeout: 120s

Capabilities

web.discovery.endpoint

web.archive.url

security.recon.passive

web.enumeration.parameter

Parameters

Name	Type	Required	Default	Description	Aliases
`flag-o`	string	No	-	Output file path	`-o`, `--output`
`flag-providers`	string	No	-	Comma-separated list of providers (wayback,otx,commoncrawl)	`-p`, `--providers`
`flag-subdomains`	boolean	No	-	Include subdomain URLs	-
`flag-blacklist`	string	No	-	File extensions to exclude	`-b`, `--blacklist`
`flag-threads`	integer	No	-	Number of concurrent threads	`-t`, `--threads`
`flag-verbose`	boolean	No	-	Verbose output	`-v`, `--verbose`

Artifacts

Type	Description	MIME	Schema	Trust
`crawl.txt`	Collected historical URLs	text/plain	-	verified

Contract

Inputs

network.target.domain

Target domain to gather URLs for

Outputs

crawl.txt

Aggregated list of historical URLs from multiple sources

Side effects: network_traffic

Workflow Edges

Produces

crawl.txt

Consumes

network.target.domain

Resource Profile

Resource	Value
CPU	low
Memory	32 MB
Network	low
Disk I/O	low

Examples

Fetch all URLs for a domain

gau example.com

Fetch URLs including subdomains

gau --subdomains example.com

Fetch from specific providers only

gau --providers wayback,otx example.com

Exclude common file extensions

gau --blacklist png,jpg,gif,css example.com

Multiple domains from stdin

cat domains.txt | gau --subdomains

Pipeline to probe live hosts

gau example.com | sort -u | httpx -status-code -title

Documentation

gau — Get All URLs

gau (Get All URLs) collects URLs from multiple public sources including the Wayback Machine, AlienVault OTX, and CommonCrawl. It provides comprehensive passive endpoint discovery for web security assessments and bug bounty hunting.

Common Pipelines

# Find parameters
gau target.com | grep "?.*=" | sort -u

# Find JavaScript files
gau target.com | grep "\.js$" | sort -u

# Pipeline probe live hosts
gau target.com | sort -u | httpx -status-code -title -json

# Full passive recon
echo target.com | gau --subdomains | sort -u | httpx -silent | nuclei -t cves/

Related Tools

waybackurlsparamspiderkatanaarjun

References

gau GitHub