Content Discovery
Discover Paths via OSINT Sources
Search OSINT sources for a host list to find hidden paths. Historical and recent URLs, normalized. Thousands of hosts. No traffic to the target.
What Discover Paths via OSINT Sources does
Hidden path discovery does not have to send traffic to the target. OSINT path discovery reads what third-party and archived sources already recorded about your hosts, so you can recover historical and deleted paths without touching the live surface. Feed it a host list and the module aggregates historical and recent URLs, then cleans and normalizes them so semantic duplicates collapse. It is passive against the target, which makes it safe to run first, before or beside the live crawl and brute force siblings.
You pass a file of hostnames and the module returns third-party and archived URLs those sources already recorded for those hosts. It aggregates historical and recent data, then cleans and normalizes URLs so semantic duplicates collapse. It does not send HTTP to the target, does not prove liveness, and does not guess with a wordlist.
Where it fits in the pipeline
Pipeline guidance
Upstream: A host list from Enumerate Hostnames via OSINT Sources, Enumerate Hostnames via Root Domain DNS Brute Force, or any hostname enumerator. Input is hosts, not URLs.
Downstream: Recovered urls feed Probe for Web Servers to prove liveness, then Scan for Sensitive Files, Scan for Exposed Backups, and Fuzz Web Applications for Vulnerabilities.
Parallel: Discover Paths via Crawling and Discover Paths via Directory Brute Force. Same urls / url-details shape, different data_source. Those send live HTTP. This does not.
When to use this
Nest this as a passive seed, before or beside the live path modules. You pass hostnames, not URLs. No HTTP reaches the target. New hosts with empty archives return little. Drop the subgraph on a host list from DNS or hostname OSINT; do not feed it live URLs.
Data
The tables this module produces. Sample rows are illustrative.
Recovered path list: third-party and archived URLs for the input hosts.
urlurl | |
|---|---|
| 1 | https://example.com/old/login |
| 2 | https://example.com/2025/01/report.pdf |
| 3 | https://staging.example.com/internal/dashboard |
JSONLines per recovered URL with source attribution.
urlurl | methodtext | status_codeint | titletext | content_lengthint | hostnametext | |
|---|---|---|---|---|---|---|
| 1 | https://example.com/old/login | GET | 301 | Moved Permanently | 0 | example.com |
| 2 | https://example.com/2025/01/report.pdf | GET | 200 | 524288 | example.com | |
| 3 | https://staging.example.com/internal/dashboard | GET | 404 | Not Found | 312 | staging.example.com |
How it differs from similar modules
Artifact class it owns
Unlinked paths from a wordlist; masked 404s dropped
Upstream it needs
Live web server URLs
Artifact class it owns
Linked paths, including JavaScript the crawl can see
Upstream it needs
Live web server URLs
Discover Paths via OSINT Sources
Artifact class it owns
Third-party and archived URLs for those hosts
Upstream it needs
Hostnames
questions
Discover Paths via OSINT Sources questions
Nest Discover Paths via OSINT Sources in a workflow
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
See Trickest in Action
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.