Discovery
Mine API paths from a list of JS URLs
LinkFinder over a file of JavaScript URLs, with -r filter and -c cookies.
overview
What mass-linkfinder does
mass-linkfinder takes a urls-file of JavaScript URLs and runs LinkFinder on each one. Output is a FILE and FOLDER of endpoints and parameters. Optional -r keeps only matching paths; -c attaches cookies when scripts need a session.
Reach for it after a JS collector such as getjs has already listed the bundles. SPA and bundled apps hide API routes in script bodies that HTML crawlers never see.
Trickest runs it as a managed Discovery node. Prefer plain linkfinder for a single file. Prefer golinkfinder when you want a Go reimplementation on one target at a time.
use cases
Where mass-linkfinder fits
Mine endpoints from a target's JavaScript
Collect every JS URL a site loads, then run mass-linkfinder over the whole list to recover API routes and paths defined in bundled script that a static crawler never reaches.
Surface parameters worth fuzzing
LinkFinder reports both endpoints and the parameters they take, so the output seeds parameter-fuzzing and content-discovery stages with real names instead of guesses.
Read authenticated scripts
Pass session cookies so the wrapper fetches JS bundles served only to logged-in users, exposing routes that anonymous crawling leaves invisible.
Keep the output focused with a regex
Filter matches against a pattern like ^/api/ so the result holds only the endpoint class you want, ready to hand to a prober or scanner without manual cleanup.
reference
mass-linkfinder inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| urls-file | FILE | · | List of JS URLs to analyze, one per line. |
| filter-regex | STRING | -r | RegEx for filtering found endpoints, e.g. ^/api/ to keep only API paths. |
| cookies | STRING | -c | Cookies to add to each request, for fetching authenticated JavaScript. |
Showing key inputs. mass-linkfinder exposes 3 inputs in total.
example
Run mass-linkfinder
# extract endpoints from every JS URL in the list, keep only API pathsmass-linkfinder -c "session=6f1a2b; csrf=9b2c4d" -r '^/api/' js-urls.txt/api/v1/users/api/v1/login/api/v2/orders?id=/api/v2/accounts/{account_id}/internal/health/admin/config.json/graphql/static/js/settings.chunk.jsguidance
Choosing mass-linkfinder
Use mass-linkfinder when you already have a list of JavaScript URLs and want endpoints and parameters from all of them in one pass. It does not collect URLs. Run getjs first. For one file, use linkfinder.
linkfinder
Single-file LinkFinder. Use when you have one script, not a list.
golinkfinder
Go reimplementation of the same idea on one target at a time.
getjs
Collects JS URLs. Run it before mass-linkfinder, not instead of it.
faq
mass-linkfinder questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run mass-linkfinder yourself
A target's JS URLs feed getjs, which collects the script links and passes them to mass-linkfinder, which extracts every endpoint and writes them as a queryable output.
Facts on this page come from the live Trickest tool library.