Discovery
Pull endpoints from a page HTML and JavaScript
Single-URL extractor for endpoints in HTML and embedded scripts.
overview
What golinkfinder does
golinkfinder is the single-page Discovery step after a prober confirms a URL is live. It reads the page HTML and the JavaScript embedded in or linked from it, then writes the paths and API routes it finds.
Reach for it when a SPA hides routes in bundled script that an anchor-following crawler never sees. One --domain input; no crawl depth or scope flags to tune.
Output is a file and folder of endpoints. Hand that list to httpx, content discovery, or a scanner. For multi-page JavaScript-aware crawling, use katana instead.
use cases
Where golinkfinder fits
Pull endpoints from embedded JavaScript
Point golinkfinder at a page to recover API routes and links defined in script that an anchor-following crawler would never reach.
Map a single-page app's routes
Extract the paths bundled into a SPA's JavaScript so the rest of the workflow probes real endpoints instead of only the visible navigation.
Seed the next probing stage
Hand the extracted endpoints to httpx or a scanner so probing runs against paths pulled straight from the page's own code.
Quick recon on a confirmed-live target
Bug hunters and red teamers point it at one live URL to surface a starting map of paths before committing to deeper crawling or fuzzing.
reference
golinkfinder inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| domain | STRING | --domain | The target URL to extract endpoints from its HTML and embedded JavaScript. |
Showing key inputs. golinkfinder exposes 1 inputs in total.
example
Run golinkfinder
# extract endpoints from a live page's HTML and JavaScriptGoLinkFinder -d https://example.com -o endpoints.txthttps://example.com/api/v1/usershttps://example.com/api/v1/auth/session/static/js/app.4f2a1c.js/static/js/vendor.bundle.js/api/v2/search?q=/api/v1/orders/12873https://cdn.example.com/config.json/account/settingsguidance
Choosing golinkfinder
Use golinkfinder when you have one live URL and need endpoints buried in its HTML and JavaScript. It is single-shot by design. For crawling many pages or deeper JS parsing, reach for katana or a dedicated link finder.
linkfinder
Python original. Extracts endpoints from JavaScript with regex patterns.
getjs
Fetches the JavaScript files a page references so you can mine them for endpoints next.
katana
Full crawler with JavaScript awareness. Covers many pages where golinkfinder handles one.
faq
golinkfinder questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run golinkfinder yourself
A target URL feeds golinkfinder, which extracts endpoints from its HTML and JavaScript and passes them to httpx so only live ones land as output.
Facts on this page come from the live Trickest tool library.