loading
loading
Recon
Module-driven extractor for Wayback Machine page history.
overview
chronos reads a target Wayback Machine history and runs extraction modules over archived snapshots. Old pages often still hold paths, parameters, and hostnames the live site dropped. The archive answers; the live host is not contacted for the mine.
Choose extractors with -module. Bound the window with -from and -to, cap volume with -limit, and keep relevant captures via -match-status or -match-mime. -snapshot-interval thins dense history to roughly one capture per hour, day, month, or year.
The node takes a -target URL or domain and writes a file and a folder of module output. Use it in passive recon, then feed extracted URLs to httpx. Prefer gau or waymore when you only need a flat archived URL list.
source github.com/mhmdiaa/chronos
use cases
Mine a target's archived snapshots for paths and parameters the live site dropped, then probe them to see which still work.
Use from and to filters to focus on a specific window of history, such as around a known deployment or breach.
Match or filter by MIME type and status code so a run returns only the snapshot types and responses worth extracting from.
Set a snapshot interval to keep at most one capture per hour, day, month, or year so a heavily archived site stays manageable.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| target | STRING | -target | Target URL or domain to mine (supports wildcards). |
| module | STRING | -module | Comma-separated list of extraction modules to run. |
| from | STRING | -from | Filter snapshots from a date (yyyyMMddhhmmss). |
| to | STRING | -to | Filter snapshots to a date (yyyyMMddhhmmss). |
| limit | STRING | -limit | Limit snapshots processed; negative for newest N, positive for oldest N (default -50). |
| match-mime | STRING | -match-mime | Comma-separated MIME types to match. |
| match-status | STRING | -match-status | Comma-separated status codes to match (default 200). |
| threads | STRING | -threads | Number of concurrent threads (default 10). |
Showing key inputs. chronos exposes 15 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| target | STRING | -target | Target URL or domain to mine (supports wildcards). |
| module | STRING | -module | Comma-separated list of extraction modules to run. |
| from | STRING | -from | Filter snapshots from a specific date (format yyyyMMddhhmmss). |
| to | STRING | -to | Filter snapshots to a specific date (format yyyyMMddhhmmss). |
| limit | STRING | -limit | Limit snapshots processed; negative for the newest N, positive for the oldest N (default -50). |
| snapshot-interval | STRING | -snapshot-interval | Keep at most one snapshot per interval (h, d, m, or y). |
| threads | STRING | -threads | Number of concurrent threads to use (default 10). |
| match-mime | STRING | -match-mime | Comma-separated list of MIME types to match. |
| filter-mime | STRING | -filter-mime | Comma-separated list of MIME types to filter out. |
| match-status | STRING | -match-status | Comma-separated list of status codes to match (default 200). |
| filter-status | STRING | -filter-status | Comma-separated list of status codes to filter out. |
| one-per-url | BOOLEAN | -one-per-url | Fetch only one snapshot per URL. |
| list-modules | BOOLEAN | -list-modules | List the available extraction modules. |
| module-config | STRING | -module-config | Set module configuration inline as module.key=value. |
| module-config-file | FILE | -module-config-file | Path to a module configuration file. |
example
# list available modules, then mine the newest 200 snapshots of a domainchronos -list-moduleschronos -target 'example.com/*' -from 20180101000000 -to 20220101000000 -limit -200 -match-status 200 -threads 2020170924043318 https://example.com/api/v1/auth/login20170924043318 https://example.com/assets/js/app.bundle.min.js20181103221540 https://example.com/admin/legacy/export20190215130244 https://example.com/beta/checkout?ref=email20200418095112 https://api.example.com/internal/metrics20200711164233 https://staging.example.com/v2/users20211129072905 https://example.com/.git/config… 214 endpoints extracted from 200 snapshots of example.comguidance
Reach for chronos when historical endpoints matter as much as the live site. It reads the archive, not the target. Use gau or waymore for a flat archived URL dump instead of module extraction.
Dumps archived URLs from Wayback and other sources. chronos extracts structured data from snapshot contents.
Pulls a deep set of archived URLs and responses. chronos is module-driven for targeted extraction.
Fetches historical robots.txt entries. chronos covers a wider slice of the archive.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A domain feeds chronos, which mines its Wayback history for endpoints and passes them to httpx so only the ones still live land as output.
Facts on this page come from the live Trickest tool library.