Recon
Pull a domain's endpoints from public GitHub
Find endpoints for a domain in public GitHub code.
overview
What github-endpoints does
github-endpoints searches public GitHub for URLs and paths that reference a target domain. Config files, client code, and docs often name routes a live crawler never links. You get an endpoint list mined from committed source.
Searches use the GitHub code-search API, so pass tokens with -t (comma list or file). -q skips extra language and noise searches. -e also looks for dummy-prefixed domain variants. -r prints relative URLs; -all includes other domains found.
Pass tokens with -t as a comma list or file. Seed content discovery or httpx with paths from source instead of wordlist guesses; the managed node writes a file and folder of endpoints.
use cases
Where github-endpoints fits
Recover endpoints from committed source
Search public GitHub for a domain to pull API routes and paths out of config files and client code that a live crawl would never reach.
Seed content discovery with real paths
Feed the harvested endpoints into a fuzzer or prober so the next stage tests paths that exist instead of generic wordlist guesses.
Rotate tokens to cover wide scopes
Supply a comma-separated token list or a token file so the tool spreads requests across keys and keeps searching past a single token's rate limit.
Monitor GitHub for newly exposed endpoints
Schedule the node against your domains and diff the results to catch new paths as developers push code that references them.
reference
github-endpoints inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain you are looking for (required). |
| tokens | STRING | -t | List of GitHub API tokens separated by commas. |
| tokens-file | FILE | -t | A file containing one GitHub API token per line. |
| quick | BOOLEAN | -q | Quick mode; skip the extra language searches and added noise. |
| extended-mode | BOOLEAN | -e | Extended mode; also look for dummy-prefixed variants of the domain. |
| relative | BOOLEAN | -r | Display relative URLs instead of absolute (default false). |
| all | BOOLEAN | -all | Display URLs of all other domains found, not only the target. |
| raw | BOOLEAN | -raw | Emit raw output with no formatting. |
Showing key inputs. github-endpoints exposes 9 inputs in total.
Full flag reference (9 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| all | BOOLEAN | -all | Display URLs of all other domains found, not only the target. |
| raw | BOOLEAN | -raw | Emit raw output with no formatting. |
| quick | BOOLEAN | -q | Quick mode; skip the extra language searches and added noise. |
| domain | STRING | -d | Domain you are looking for (required). |
| tokens | STRING | -t | List of GitHub API tokens separated by commas. |
| relative | BOOLEAN | -r | Display relative URLs instead of absolute (default false). |
| tokens-file | FILE | -t | A file containing one GitHub API token per line. |
| extended-mode | BOOLEAN | -e | Extended mode; also look for dummy-prefixed variants of the domain. |
| exit-when-tokens-get-limited | BOOLEAN | -k | Exit the program once every token has been rate-limited. |
example
Run github-endpoints
# harvest endpoints for a domain, rotating a token file, quick passgithub-endpoints -d example.com -t tokens.txt -qhttps://api.example.com/v1/usershttps://api.example.com/v2/auth/loginhttps://app.example.com/internal/healthhttps://staging.example.com/api/ordershttps://example.com/.well-known/security.txthttps://cdn.example.com/assets/config.jsonhttps://dev.example.com/graphqlhttps://example.com/admin/settingsguidance
Choosing github-endpoints
Use github-endpoints when you want paths that live in source code, not on the running site. It needs GitHub API tokens via -t. Pair with github-subdomains for the same passive source, and with golinkfinder or gau for live-page or archive URLs.
github-subdomains
Same author and token model. Harvests subdomains instead of endpoints from public GitHub.
golinkfinder
Extracts endpoints from live HTML and JavaScript, not from committed source.
gau
Pulls historical URLs from web archives. Different passive source for the same inventory goal.
faq
github-endpoints questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run github-endpoints yourself
A domain feeds github-endpoints, which mines public GitHub for paths and hands them to httpx so only endpoints that respond land as output.
Facts on this page come from the live Trickest tool library.