loading
Loading content
loading
Discovery
LinkFinder over a file of JavaScript URLs, with -r filter and -c cookies.
overview
mass-linkfinder takes a urls-file of JavaScript URLs and runs LinkFinder on each one. Output is a FILE and FOLDER of endpoints and parameters. Optional -r keeps only matching paths; -c attaches cookies when scripts need a session.
Reach for it after a JS collector such as getjs has already listed the bundles. SPA and bundled apps hide API routes in script bodies that HTML crawlers never see.
Trickest runs it as a managed Discovery node. Prefer plain linkfinder for a single file. Prefer golinkfinder when you want a Go reimplementation on one target at a time.
use cases
Collect every JS URL a site loads, then run mass-linkfinder over the whole list to recover API routes and paths defined in bundled script that a static crawler never reaches.
LinkFinder reports both endpoints and the parameters they take, so the output seeds parameter-fuzzing and content-discovery stages with real names instead of guesses.
Pass session cookies so the wrapper fetches JS bundles served only to logged-in users, exposing routes that anonymous crawling leaves invisible.
Filter matches against a pattern like ^/api/ so the result holds only the endpoint class you want, ready to hand to a prober or scanner without manual cleanup.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| urls-file | FILE | · | List of JS URLs to analyze, one per line. |
| filter-regex | STRING | -r | RegEx for filtering found endpoints, e.g. ^/api/ to keep only API paths. |
| cookies | STRING | -c | Cookies to add to each request, for fetching authenticated JavaScript. |
Showing key inputs. mass-linkfinder exposes 3 inputs in total.
example
# extract endpoints from every JS URL in the list, keep only API pathsmass-linkfinder -c "session=6f1a2b; csrf=9b2c4d" -r '^/api/' js-urls.txt/api/v1/users/api/v1/login/api/v2/orders?id=/api/v2/accounts/{account_id}/internal/health/admin/config.json/graphql/static/js/settings.chunk.jsguidance
Use mass-linkfinder when you already have a list of JavaScript URLs and want endpoints and parameters from all of them in one pass. It does not collect URLs. Run getjs first. For one file, use linkfinder.
Single-file LinkFinder. Use when you have one script, not a list.
Go reimplementation of the same idea on one target at a time.
Collects JS URLs. Run it before mass-linkfinder, not instead of it.
faq
related
Extract URLs and endpoints from Android APK files.
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
A target's JS URLs feed getjs, which collects the script links and passes them to mass-linkfinder, which extracts every endpoint and writes them as a queryable output.
Facts on this page come from the live Trickest tool library.