loading
Loading content
loading
Discovery
Endpoints and parameters from crawls and saved traffic.
overview
xnLinkFinder takes --input as a URL or domain crawl, a URL list, Burp XML, ZAP output, Caido CSV, or a directory of files, then returns endpoints plus a target-specific wordlist of path words and parameters.
Cap recursion with --depth. Keep output usable with --scope-filter, --scope-prefix, and --exclude. Stop early on rate limits with -s403, -s429, -sTO, or -sCE when most responses fail.
Reach for it after you have URLs or proxy traffic and need a route map before probing. Prefer katana for a deeper live JS-aware crawl; use gau when you want passive archive URLs instead. Trickest runs it as a managed Discovery node.
use cases
Give it a URL or domain and a --depth so it follows links recursively, returning the full set of routes the application exposes.
Parse a Burp or ZAP export, a Caido CSV, or a directory of saved files to recover endpoints and parameters from traffic you already captured.
Read a page or a saved .js file and pull routes out of inline and external JavaScript, the way LinkFinder does but across a whole crawl.
Collect path words, parameters, and page text into a tuned wordlist that seeds content discovery and parameter fuzzing better than a generic list.
Apply --scope-filter and --scope-prefix to restrict and normalize output links, so the endpoint set stays on assets you are allowed to test.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| input | STRING | --input | Input a URL or domain to crawl. |
| input-file | FILE | --input | Input a text file of URLs, a Burp XML, a ZAP output, or a Caido CSV to parse. |
| depth | STRING | --depth | Levels of depth to search; found links are searched again for more links (default 1). |
| scope-filter | STRING | --scope-filter | Keep only links whose domain is in the given scope. |
| scope-prefix | STRING | --scope-prefix | Prefix links starting with / with the scope domain in the output. |
| exclude | STRING | --exclude | Exclude links matching a comma separated list, e.g. careers,forum. |
| headers | STRING | --headers | Custom headers to send, format 'Header1: value1; Header2: value2;'. |
| processes | STRING | --processes | Number of processes (threads) used for requests (default 25). |
Showing key inputs. xnlinkfinder exposes 48 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| depth | STRING | --depth | Levels of depth to search; links found are searched again for more links (default 1). Ignored for Burp files. |
| input | STRING | --input | Input a URL or domain to crawl. |
| config | FILE | --config | Path to the YAML config file; excludes some words and extensions and defines stopwords. |
| origin | BOOLEAN | --origin | Show the origin of each link, printed as LINK-URL [ORIGIN-URL] (default false). |
| cookies | STRING | --cookies | Cookies to send with requests, format 'name1=value1; name2=value2;'. |
| exclude | STRING | --exclude | Link exclusions as a comma separated list, e.g. careers,forum. |
| headers | STRING | --headers | Custom headers to send, format 'Header1: value1; Header2: value2;'. |
| include | BOOLEAN | --include | Include the input links in the output (default false). |
| timeout | STRING | --timeout | Seconds to wait for the server to send data before giving up (default 10). |
| verbose | BOOLEAN | --verbose | Verbose output. |
| all-tlds | BOOLEAN | --all-tlds | Return links even when the TLD is not in the common list; can add false positives. |
| insecure | BOOLEAN | -insecure | Disable TLS certificate checks on requests (default false). |
| prefixed | BOOLEAN | --prefixed | Mark prefixed links with (PREFIXED) after the link and origin (default false). |
| no-banner | BOOLEAN | --no-banner | Hide the tool banner. |
| processes | STRING | --processes | Number of processes (threads) used for URL requests (default 25). |
| ascii-only | BOOLEAN | -ascii-only | Only add links and parameters that contain ASCII characters (default false). |
| input-file | FILE | --input | Input a text file of URLs, a Burp XML, a ZAP output, a Caido CSV, or a single file to search. |
| user-agent | STRING | --user-agent | Which User Agents to get links for, e.g. 'desktop mobile'. |
| regex-after | STRING | --regex-after | RegEx to filter found endpoints before output; a link is kept only if it matches. |
| stop-on-403 | BOOLEAN | -s403 | Stop when over 95 percent of responses return 403 Forbidden (default false). |
| stop-on-429 | BOOLEAN | -s429 | Stop when over 95 percent of responses return 429 Too Many Requests (default false). |
| input-folder | FOLDER | --input | Input a directory of files to search for links. |
| replay-proxy | STRING | -replay-proxy | Replay active requests for a URL or file of URLs through this proxy. |
| scope-filter | STRING | --scope-filter | Keep only links whose domain is in the given scope. |
| scope-prefix | STRING | --scope-prefix | Prefix links starting with / with the scope domain in the output. |
| very-verbose | BOOLEAN | --vverbose | Increased verbose output. |
| max-file-size | STRING | --max-file-size | Max file size in bytes to check when input is a directory (default 500 MB); 0 means no limit. |
| content-length | BOOLEAN | --content-length | Show the Content-Length of the response when crawling. |
| max-time-limit | STRING | --max-time-limit | Max run time in minutes before stopping (default 0, no limit). |
| stopwords-file | STRING | --stopwords-file | File of extra stop words to exclude from the target-specific wordlist. |
| stop-on-timeout | BOOLEAN | -sTO | Stop when over 95 percent of requests time out (default false). |
| wordlist-maxlen | STRING | --wordlist-maxlen | Max length of words added to the target-specific wordlist (excluding plurals). |
| memory-threshold | STRING | --memory-threshold | Memory usage percentage that ends the run gracefully before running out of memory (default 95). |
| scope-filter-file | FILE | --scope-filter | File of domains; keep only links whose domain is in scope. |
| scope-prefix-file | FILE | --scope-prefix | File of scope domains used to prefix links starting with /. |
| user-agent-custom | STRING | --user-agent-custom | A custom User Agent string for all requests; overrides --user-agent. |
| no-wordlist-digits | BOOLEAN | --no-wordlist-digits | Exclude words containing numerical digits from the wordlist. |
| no-wordlist-imgalt | BOOLEAN | --no-wordlist-imgalt | Do not process image alt attributes for the wordlist. |
| no-wordlist-plurals | BOOLEAN | --no-wordlist-plurals | Do not add singular or plural variants of found words to the wordlist. |
| burpfile-remove-tags | STRING | --burpfile-remove-tags | Remove tags when a Burp file is input; pass True or False (asked interactively if omitted). |
| no-wordlist-comments | BOOLEAN | --no-wordlist-comments | Do not process page comments for the wordlist. |
| no-wordlist-lowercase | BOOLEAN | --no-wordlist-lowercase | Do not also add lowercase copies of words that contain uppercase characters. |
| no-wordlist-pathwords | BOOLEAN | --no-wordlist-pathwords | Do not process path words found in links for the wordlist. |
| scope-prefix-original | BOOLEAN | --scope-prefix-original | When a scope prefix is set, also keep the original link starting with / (default false). |
| exclude-relative-links | BOOLEAN | -xrel | Drop relative links that start with ./ or ../ from the results. |
| no-wordlist-parameters | BOOLEAN | --no-wordlist-parameters | Do not process parameters found in links for the wordlist. |
| scope-prefix-keep-failed | BOOLEAN | --scope-prefix-keep-failed | Keep a prefixed link even if it returned 404 or raised a request error (default false). |
| stop-on-connection-errors | BOOLEAN | -sCE | Stop when over 95 percent of requests have connection errors (default false). |
example
# crawl example.com two levels deep and keep results in scopexnLinkFinder -i example.com -d 2 -sf example.com -sp https://example.com -o endpoints.txt//login/api/v1/users/api/v1/users/{id}/roles/static/js/app.8f3c1d.js/assets/manifest.jsonhttps://example.com/account/settings?tab=https://example.com/api/v2/search?q=&page=… (214 endpoints and 38 parameters written to output/ for the real run)guidance
Use xnLinkFinder when you need endpoints and a target-specific parameter wordlist from a crawl or saved Burp, ZAP, or Caido traffic. For a deeper live JS-aware crawl, katana goes further; for passive archive URLs, gau pulls history.
Active crawler with JavaScript parsing. Deeper live crawl; xnLinkFinder also mines saved proxy traffic and builds wordlists.
Passive URLs from web archives. Complements xnLinkFinder active crawl and file-based discovery.
faq
related
Extract URLs and endpoints from Android APK files.
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
A target feeds xnLinkFinder, which extracts endpoints and a parameter wordlist and passes the routes to httpx for live probing before they land as a queryable output.
Facts on this page come from the live Trickest tool library.