Discovery
LinkFinder: pull API routes out of JavaScript
Discover endpoints and parameters inside JavaScript files.
overview
What linkfinder does
LinkFinder takes a URL or local JavaScript file via -i, beautifies the source, then regex-extracts paths, API routes, and parameters that HTML crawlers miss. SPA bundles often hide navigation here.
Enable -d to enumerate JavaScript under a domain. Filter with -r (for example ^/api/). Feed a Burp Save selected export with -b. Add -c when the fetch needs cookies.
Slot it after a crawler that collected scripts, then hand routes to httpx or a scanner. Prefer LinkFinder for a light regex sweep; use jsluice when you want tree-sitter parsing and secret extraction too. Trickest runs it as a managed Discovery node.
use cases
Where linkfinder fits
Recover endpoints from JavaScript
Analyze a script to surface API routes and paths defined in JavaScript that never appear as links in the rendered HTML.
Sweep every JS file on a domain
Use the -d toggle to enumerate all JavaScript under a target and extract endpoints from each one in a single pass.
Process a Burp script export
Feed a Burp 'Save selected' file of multiple scripts with -b so LinkFinder analyzes the whole bundle captured during a manual session.
Filter to the routes that matter
Apply a regex with -r, such as ^/api/, so the output keeps only the endpoints worth probing instead of every string it matched.
reference
linkfinder inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| input-url | STRING | -i | A URL to fetch and analyze for endpoints. |
| input-file | FILE | -i | A local JavaScript file to analyze. |
| analyze-entire-domain | BOOLEAN | -d | Enumerate and analyze every JavaScript file found on the domain. |
| filter-regex | STRING | -r | Regex to filter found endpoints, e.g. ^/api/. |
| use-burp-save-selected-file | BOOLEAN | -b | Input a Burp 'Save selected' file containing multiple JS files. |
| cookies | STRING | -c | Cookies to add to the request when fetching a URL. |
Showing key inputs. linkfinder exposes 6 inputs in total.
example
Run linkfinder
# extract API endpoints from every JS file under a domainpython linkfinder.py -i https://example.com -d -r ^/api/ -o cli/api/v1/session/api/v1/users/{userId}/api/v2/orders/graphqlhttps://api.example.com/v1/notifications/static/js/vendor.4f2a9c.js/assets/settings.jsonwss://ws.example.com/stream/internal/metricsguidance
Choosing linkfinder
Use LinkFinder when you want a quick regex sweep of JavaScript for endpoints and parameters. For parser-accurate extraction that also catches concatenated URLs and secrets, jsluice is the structural sibling.
jsluice
Parses JavaScript with tree-sitter for cleaner results and secrets. LinkFinder is the lighter regex approach.
getjs
Collects JavaScript files from a target. Run it first, then point LinkFinder at the gathered scripts.
secretfinder
Sibling regex script tuned for secrets in JS rather than endpoints. Pair them for routes and credentials.
faq
linkfinder questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run linkfinder yourself
A target feeds katana, which crawls and collects JavaScript, then LinkFinder extracts the endpoints and writes them as a queryable output.
Facts on this page come from the live Trickest tool library.