Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Recon

Mine Wayback snapshots for lost endpoints

Module-driven extractor for Wayback Machine page history.

Agent
Recover historical endpointsBound the search by dateFilter to the content you want

overview

What chronos does

chronos reads a target Wayback Machine history and runs extraction modules over archived snapshots. Old pages often still hold paths, parameters, and hostnames the live site dropped. The archive answers; the live host is not contacted for the mine.

Choose extractors with -module. Bound the window with -from and -to, cap volume with -limit, and keep relevant captures via -match-status or -match-mime. -snapshot-interval thins dense history to roughly one capture per hour, day, month, or year.

The node takes a -target URL or domain and writes a file and a folder of module output. Use it in passive recon, then feed extracted URLs to httpx. Prefer gau or waymore when you only need a flat archived URL list.

source github.com/mhmdiaa/chronos

use cases

Where chronos fits

Recover historical endpoints

Mine a target's archived snapshots for paths and parameters the live site dropped, then probe them to see which still work.

Bound the search by date

Use from and to filters to focus on a specific window of history, such as around a known deployment or breach.

Filter to the content you want

Match or filter by MIME type and status code so a run returns only the snapshot types and responses worth extracting from.

Thin dense archive history

Set a snapshot interval to keep at most one capture per hour, day, month, or year so a heavily archived site stays manageable.

reference

chronos inputs and flags

15 inputs
NameTypeFlagDescription
targetSTRING-targetTarget URL or domain to mine (supports wildcards).
moduleSTRING-moduleComma-separated list of extraction modules to run.
fromSTRING-fromFilter snapshots from a date (yyyyMMddhhmmss).
toSTRING-toFilter snapshots to a date (yyyyMMddhhmmss).
limitSTRING-limitLimit snapshots processed; negative for newest N, positive for oldest N (default -50).
match-mimeSTRING-match-mimeComma-separated MIME types to match.
match-statusSTRING-match-statusComma-separated status codes to match (default 200).
threadsSTRING-threadsNumber of concurrent threads (default 10).

Showing key inputs. chronos exposes 15 inputs in total.

Full flag reference (15 inputs)
NameTypeFlagDescription
targetSTRING-targetTarget URL or domain to mine (supports wildcards).
moduleSTRING-moduleComma-separated list of extraction modules to run.
fromSTRING-fromFilter snapshots from a specific date (format yyyyMMddhhmmss).
toSTRING-toFilter snapshots to a specific date (format yyyyMMddhhmmss).
limitSTRING-limitLimit snapshots processed; negative for the newest N, positive for the oldest N (default -50).
snapshot-intervalSTRING-snapshot-intervalKeep at most one snapshot per interval (h, d, m, or y).
threadsSTRING-threadsNumber of concurrent threads to use (default 10).
match-mimeSTRING-match-mimeComma-separated list of MIME types to match.
filter-mimeSTRING-filter-mimeComma-separated list of MIME types to filter out.
match-statusSTRING-match-statusComma-separated list of status codes to match (default 200).
filter-statusSTRING-filter-statusComma-separated list of status codes to filter out.
one-per-urlBOOLEAN-one-per-urlFetch only one snapshot per URL.
list-modulesBOOLEAN-list-modulesList the available extraction modules.
module-configSTRING-module-configSet module configuration inline as module.key=value.
module-config-fileFILE-module-config-filePath to a module configuration file.

example

Run chronos

chronos · command
# list available modules, then mine the newest 200 snapshots of a domainchronos -list-moduleschronos -target 'example.com/*' -from 20180101000000 -to 20220101000000 -limit -200 -match-status 200 -threads 20
sample output
20170924043318  https://example.com/api/v1/auth/login20170924043318  https://example.com/assets/js/app.bundle.min.js20181103221540  https://example.com/admin/legacy/export20190215130244  https://example.com/beta/checkout?ref=email20200418095112  https://api.example.com/internal/metrics20200711164233  https://staging.example.com/v2/users20211129072905  https://example.com/.git/config…  214 endpoints extracted from 200 snapshots of example.com

guidance

Choosing chronos

Reach for chronos when historical endpoints matter as much as the live site. It reads the archive, not the target. Use gau or waymore for a flat archived URL dump instead of module extraction.

gau

Dumps archived URLs from Wayback and other sources. chronos extracts structured data from snapshot contents.

waymore

Pulls a deep set of archived URLs and responses. chronos is module-driven for targeted extraction.

waybackrobots

Fetches historical robots.txt entries. chronos covers a wider slice of the archive.

faq

chronos questions

The Internet Archive Wayback Machine. chronos reads archived snapshots, so it mines history without requesting the live site.

related

More Recon tools

  1. amass

    Multi-source subdomain discovery; hand names to httpx.

  2. amass-intel

    OWASP Amass intel: map an organization's root domains and ranges.

  3. assetfinder

    Find domains and subdomains potentially related to a given domain.

  4. bbot

    Modular OSINT recon that chains modules from a seed target.

  5. bevigil

    CLI client for the BeVigil OSINT API, keyed by domain or app package.

  6. cloud-enum

    Multi-cloud public name enumeration for AWS, Azure, and GCP.

Run chronos yourself

A domain feeds chronos, which mines its Wayback history for endpoints and passes them to httpx so only the ones still live land as output.

Open chronos in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.