loading
Loading content
loading
Scanners
Find broken links, missing images, and other dead references within your HTML.
overview
broken-link-checker reads an HTML document, extracts every link and reference, and requests each one to find what no longer resolves. Dead links and missing images hurt user experience, but for security work they also flag stale third-party hosts and abandoned subdomains that a broken link still points at, which is where subdomain takeover starts.
It can recurse through a site, separate internal links from external, and tune concurrency per host so it does not hammer one origin. A filter level controls which tags count as links, from clickable anchors only up to stylesheets, scripts, forms, and metadata, so you decide how deep the reference graph goes.
Wire broken-link-checker as a Scanners node that takes a URL and writes a file and a folder of results. Run it across a site to inventory dead references, then feed the broken external hosts into takeover and DNS checks downstream.
use cases
Crawl an HTML document recursively and list every broken link and missing image so content and reliability issues surface in one report.
Pull the broken external links a page points at, since a dead reference to an unclaimed host is exactly where a subdomain or service takeover begins.
Exclude internal or external links so a run focuses on either your own content health or the third-party hosts you depend on.
Set concurrent requests and per-host limits so a recursive scan covers a large site without overwhelming any single origin.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| input | STRING | --input | URL to an HTML document to check. |
| recrusive | BOOLEAN | --recrusive | Recursively scan, crawling the linked HTML documents. |
| filter-level | STRING | --filter-level | Which tags count as links, from clickable anchors up to metadata. |
| exclude | STRING | --exclude | A keyword or glob to match links against and skip. |
| exclude-external | BOOLEAN | --exclude-external | Do not check external links. |
| requests | STRING | --requests | Concurrent requests limit. |
| host-requests | STRING | --host-requests | Concurrent requests limit per host. |
| verbose | BOOLEAN | --verbose | Display excluded links. |
Showing key inputs. broken-link-checker exposes 13 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| get | BOOLEAN | --get | Change request method to GET. |
| input | STRING | --input | URL to an HTML document. |
| follow | BOOLEAN | --follow | Force-follow robot exclusions. |
| exclude | STRING | --exclude | A keyword/glob to match links against |
| ordered | BOOLEAN | --ordered | Maintain the order of links as they appear in their HTML document. |
| verbose | BOOLEAN | --verbose | Display excluded links. |
| requests | STRING | --requests | Concurrent requests limit. |
| recrusive | BOOLEAN | --recrusive | Recursively scan ("crawl") the HTML document(s). |
| user-agent | STRING | --user-agent | The user agent to use for link checks. |
| filter-level | STRING | --filter-level | The types of tags and attributes that are considered links. (options: 0 -> clickable links, 1 -> 0 + media; iframes; meta refreshes, 2 -> 1 + stylesheets; scripts; forms, 3 -> 2 + metadata) |
| host-requests | STRING | --host-requests | Concurrent requests limit per host. |
| exclude-external | BOOLEAN | --exclude-external | Will not check external links. |
| exclude-internal | BOOLEAN | --exclude-internal | Will not check internal links. |
example
# recursively check links on a site, skip mailto noisebroken-link-checker --input https://www.example.com/ --recrusive --exclude mailto --filter-level 1 --requests 10BROKEN https://old.example.com/docs/guideBROKEN https://cdn.example.net/assets/missing.pngBROKEN https://api.example.com/v0/healthBROKEN https://static.example.org/favicon.icoBROKEN https://blog.example.com/posts/archivedBROKEN https://dev.example.com/legacy/statusOK https://www.example.com/OK https://app.example.com/loginguidance
Use broken-link-checker to map dead links and missing references across a site, whether for content health or to surface takeover candidates. It checks links inside HTML, it does not enumerate hosts, so point it at a known page. To act on broken external hosts, follow it with a takeover or DNS tool.
Crawls for broken social links specifically and flags takeovers. broken-link-checker covers all link types.
Crawls for endpoints rather than checking link health. Run it to find pages, then check them here.
Tests subdomains for takeover directly. broken-link-checker surfaces the dead hosts that feed it.
faq
related
Find reflected XSS during recon by checking payload reflection.
Fast and customizable subdomain wordlist generator using patterns.
Scans software bills of materials for security vulnerabilities.
A command-line scanner that finds exposed services, files, and folders through the web root.
A CMS detection and exploitation suite.
The Swiss Army knife for automated Web Application Testing.
A page URL feeds broken-link-checker, which collects dead references and hands the broken hosts to socialhunter so confirmed takeover candidates land as a queryable output.
Facts on this page come from the live Trickest tool library.