Tool for fetching historical URLs from the Wayback Machine archive for discovering endpoints, parameters, and attack surface of target domains.
waybackurls {target} {flags} 📎 target 📎 flags waybackurls {target} {flags}Sandbox: execFile · Timeout: 60s
web.discovery.endpoint web.archive.url security.recon.passive web.enumeration.parameter | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
dates | boolean | No | - | Include timestamp for each URL | -dates |
no-subs | boolean | No | - | Exclude subdomain URLs | -no-subs |
flag-s | string | No | - | File containing list of domains | -s, --subs |
| Type | Description | MIME | Schema | Trust |
|---|---|---|---|---|
crawl.txt | Historical URLs from Wayback Machine | text/plain | - | verified |
Inputs
network.target.domain Target domain to fetch URLs for
Outputs
crawl.txt List of discovered historical URLs
network_traffic Produces
crawl.txtConsumes
network.target.domain| Resource | Value |
|---|---|
| CPU | low |
| Memory | 32 MB |
| Network | low |
| Disk I/O | low |
Fetch all historical URLs for a domain
waybackurls example.comFetch URLs and include dates
waybackurls -dates example.comFetch URLs from multiple domains
cat domains.txt | waybackurlsFilter for JavaScript files
waybackurls example.com | grep "\.js$"Filter for parameters
waybackurls example.com | grep "?.*="waybackurls is a tool by TomNomNom that fetches historical URLs for a target domain from the Wayback Machine's CDX API, enabling passive discovery of endpoints, parameters, and hidden attack surface without directly interacting with the target.
# Find JavaScript files
waybackurls target.com | grep "\.js$" | sort -u
# Find endpoints with parameters
waybackurls target.com | grep "?.*=" | sort -u
# Filter for specific file types
waybackurls target.com | grep -E "\.(php|asp|jsp)"
# Extract unique parameters
waybackurls target.com | grep -oP "[\?&]\K[^=]+" | sort -u
# Find Wayback URLs then probe with httpx
waybackurls target.com | sort -u | httpx -status-code -title