loading
Loading content
loading
Recon
Find endpoints for a domain in public GitHub code.
overview
github-endpoints searches public GitHub for URLs and paths that reference a target domain. Config files, client code, and docs often name routes a live crawler never links. You get an endpoint list mined from committed source.
Searches use the GitHub code-search API, so pass tokens with -t (comma list or file). -q skips extra language and noise searches. -e also looks for dummy-prefixed domain variants. -r prints relative URLs; -all includes other domains found.
Pass tokens with -t as a comma list or file. Seed content discovery or httpx with paths from source instead of wordlist guesses; the managed node writes a file and folder of endpoints.
use cases
Search public GitHub for a domain to pull API routes and paths out of config files and client code that a live crawl would never reach.
Feed the harvested endpoints into a fuzzer or prober so the next stage tests paths that exist instead of generic wordlist guesses.
Supply a comma-separated token list or a token file so the tool spreads requests across keys and keeps searching past a single token's rate limit.
Schedule the node against your domains and diff the results to catch new paths as developers push code that references them.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | -d | Domain you are looking for (required). |
| tokens | STRING | -t | List of GitHub API tokens separated by commas. |
| tokens-file | FILE | -t | A file containing one GitHub API token per line. |
| quick | BOOLEAN | -q | Quick mode; skip the extra language searches and added noise. |
| extended-mode | BOOLEAN | -e | Extended mode; also look for dummy-prefixed variants of the domain. |
| relative | BOOLEAN | -r | Display relative URLs instead of absolute (default false). |
| all | BOOLEAN | -all | Display URLs of all other domains found, not only the target. |
| raw | BOOLEAN | -raw | Emit raw output with no formatting. |
Showing key inputs. github-endpoints exposes 9 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| all | BOOLEAN | -all | Display URLs of all other domains found, not only the target. |
| raw | BOOLEAN | -raw | Emit raw output with no formatting. |
| quick | BOOLEAN | -q | Quick mode; skip the extra language searches and added noise. |
| domain | STRING | -d | Domain you are looking for (required). |
| tokens | STRING | -t | List of GitHub API tokens separated by commas. |
| relative | BOOLEAN | -r | Display relative URLs instead of absolute (default false). |
| tokens-file | FILE | -t | A file containing one GitHub API token per line. |
| extended-mode | BOOLEAN | -e | Extended mode; also look for dummy-prefixed variants of the domain. |
| exit-when-tokens-get-limited | BOOLEAN | -k | Exit the program once every token has been rate-limited. |
example
# harvest endpoints for a domain, rotating a token file, quick passgithub-endpoints -d example.com -t tokens.txt -qhttps://api.example.com/v1/usershttps://api.example.com/v2/auth/loginhttps://app.example.com/internal/healthhttps://staging.example.com/api/ordershttps://example.com/.well-known/security.txthttps://cdn.example.com/assets/config.jsonhttps://dev.example.com/graphqlhttps://example.com/admin/settingsguidance
Use github-endpoints when you want paths that live in source code, not on the running site. It needs GitHub API tokens via -t. Pair with github-subdomains for the same passive source, and with golinkfinder or gau for live-page or archive URLs.
Same author and token model. Harvests subdomains instead of endpoints from public GitHub.
Extracts endpoints from live HTML and JavaScript, not from committed source.
Pulls historical URLs from web archives. Different passive source for the same inventory goal.
faq
related
Multi-source subdomain discovery; hand names to httpx.
Find domains and subdomains potentially related to a given domain.
CLI client for the BeVigil OSINT API, keyed by domain or app package.
Multi-cloud public name enumeration for AWS, Azure, and GCP.
List assets from multiple cloud providers in one inventory.
Active multi-technique DNS enumeration for assessments.
A domain feeds github-endpoints, which mines public GitHub for paths and hands them to httpx so only endpoints that respond land as output.
Facts on this page come from the live Trickest tool library.