loading
Loading content
loading
Discovery
Discover endpoints and parameters inside JavaScript files.
overview
LinkFinder takes a URL or local JavaScript file via -i, beautifies the source, then regex-extracts paths, API routes, and parameters that HTML crawlers miss. SPA bundles often hide navigation here.
Enable -d to enumerate JavaScript under a domain. Filter with -r (for example ^/api/). Feed a Burp Save selected export with -b. Add -c when the fetch needs cookies.
Slot it after a crawler that collected scripts, then hand routes to httpx or a scanner. Prefer LinkFinder for a light regex sweep; use jsluice when you want tree-sitter parsing and secret extraction too. Trickest runs it as a managed Discovery node.
use cases
Analyze a script to surface API routes and paths defined in JavaScript that never appear as links in the rendered HTML.
Use the -d toggle to enumerate all JavaScript under a target and extract endpoints from each one in a single pass.
Feed a Burp 'Save selected' file of multiple scripts with -b so LinkFinder analyzes the whole bundle captured during a manual session.
Apply a regex with -r, such as ^/api/, so the output keeps only the endpoints worth probing instead of every string it matched.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| input-url | STRING | -i | A URL to fetch and analyze for endpoints. |
| input-file | FILE | -i | A local JavaScript file to analyze. |
| analyze-entire-domain | BOOLEAN | -d | Enumerate and analyze every JavaScript file found on the domain. |
| filter-regex | STRING | -r | Regex to filter found endpoints, e.g. ^/api/. |
| use-burp-save-selected-file | BOOLEAN | -b | Input a Burp 'Save selected' file containing multiple JS files. |
| cookies | STRING | -c | Cookies to add to the request when fetching a URL. |
Showing key inputs. linkfinder exposes 6 inputs in total.
example
# extract API endpoints from every JS file under a domainpython linkfinder.py -i https://example.com -d -r ^/api/ -o cli/api/v1/session/api/v1/users/{userId}/api/v2/orders/graphqlhttps://api.example.com/v1/notifications/static/js/vendor.4f2a9c.js/assets/settings.jsonwss://ws.example.com/stream/internal/metricsguidance
Use LinkFinder when you want a quick regex sweep of JavaScript for endpoints and parameters. For parser-accurate extraction that also catches concatenated URLs and secrets, jsluice is the structural sibling.
Parses JavaScript with tree-sitter for cleaner results and secrets. LinkFinder is the lighter regex approach.
Collects JavaScript files from a target. Run it first, then point LinkFinder at the gathered scripts.
Sibling regex script tuned for secrets in JS rather than endpoints. Pair them for routes and credentials.
faq
related
Extract URLs and endpoints from Android APK files.
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
A target feeds katana, which crawls and collects JavaScript, then LinkFinder extracts the endpoints and writes them as a queryable output.
Facts on this page come from the live Trickest tool library.