loading
Loading content
loading
Discovery
LinkFinder wrapped to mine endpoints from a whole list of JavaScript URLs.
overview
mass-linkfinder is a wrapper around LinkFinder that takes a list of JavaScript URLs instead of one file at a time. LinkFinder beautifies each script with jsbeautifier and runs a large regular expression over it to surface endpoints and the parameters they expect. The wrapper does this across every URL in the list, so a folder of JS bundles collected from a target turns into a single sweep rather than a one-by-one chore.
The value is in what hides inside JavaScript. Modern single-page apps define their API routes, internal paths, and request parameters in bundled script rather than static HTML, so a normal crawler never sees them. mass-linkfinder reads the script bodies directly and reports the paths it finds, which often exposes admin routes, undocumented API versions, and parameters worth fuzzing.
On Trickest it is a Discovery node that reads a file of JS URLs and writes a file and a folder of results. Feed it the output of a JS-collection tool such as getjs, optionally pass cookies for authenticated scripts, and filter the matches with a regex to keep only the endpoints you care about. The result is a structured endpoint set that downstream probing and fuzzing stages can consume.
use cases
Collect every JS URL a site loads, then run mass-linkfinder over the whole list to recover API routes and paths defined in bundled script that a static crawler never reaches.
LinkFinder reports both endpoints and the parameters they take, so the output seeds parameter-fuzzing and content-discovery stages with real names instead of guesses.
Pass session cookies so the wrapper fetches JS bundles served only to logged-in users, exposing routes that anonymous crawling leaves invisible.
Filter matches against a pattern like ^/api/ so the result holds only the endpoint class you want, ready to hand to a prober or scanner without manual cleanup.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| urls-file | FILE | · | List of JS URLs to analyze, one per line. |
| filter-regex | STRING | -r | RegEx for filtering found endpoints, e.g. ^/api/ to keep only API paths. |
| cookies | STRING | -c | Cookies to add to each request, for fetching authenticated JavaScript. |
Showing key inputs. mass-linkfinder exposes 3 inputs in total.
example
# extract endpoints from every JS URL in the list, keep only API pathsmass-linkfinder -c "session=6f1a2b; csrf=9b2c4d" -r '^/api/' js-urls.txt/api/v1/users/api/v1/login/api/v2/orders?id=/api/v2/accounts/{account_id}/internal/health/admin/config.json/graphql/static/js/settings.chunk.jsguidance
Reach for mass-linkfinder when you already have a list of JavaScript URLs and want every endpoint and parameter inside them in one pass. It does not crawl or collect URLs itself, so run a JS-collection tool first. For a single file or interactive use, the plain linkfinder node is simpler.
The single-file original. mass-linkfinder wraps it to take a whole list of JS URLs at once.
A Go reimplementation of the same idea. Faster startup, fewer of LinkFinder's regex edge cases.
Collects the JS URLs in the first place. Run it before mass-linkfinder, not instead of it.
faq
related
Check whether a URL redirects to a masked 404 page.
Append lines to a file only if they are not already there.
Extract URLs and endpoints from Android APK files.
Visual inspection of websites across a large number of hosts.
Find suspicious files across a large set of AWS S3 buckets.
An automated tool that checks for backup artifacts that may disclose a web application's source code.
A target's JS URLs feed getjs, which collects the script links and passes them to mass-linkfinder, which extracts every endpoint and writes them as a queryable output.
Facts on this page come from the live Trickest tool library.