A Python script that discovers endpoints and their parameters in JavaScript files for penetration testing and bug hunting.
LinkFinder is a Python script that discovers endpoints and their parameters in JavaScript files. It helps security professionals find hidden endpoints on websites during penetration testing and bug hunting, potentially revealing new vulnerabilities. The tool uses jsbeautifier and a comprehensive regular expression to parse JavaScript files and extract URL patterns.
Penetration testers, bug bounty hunters, and security researchers who need to discover hidden endpoints and parameters in JavaScript files during web application security assessments.
LinkFinder automates the tedious manual process of searching through JavaScript files for endpoints, saving time and increasing coverage during reconnaissance. It offers multiple input options, filtering capabilities, and both HTML and CLI output formats for flexibility in different testing scenarios.
A python script that finds endpoints in JavaScript files
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses a large regular expression to find full URLs, absolute/dotted URLs, and relative URLs, covering various endpoint patterns as detailed in the README.
Accepts URLs, files, folders, and Burp Suite saved items, offering flexibility for different reconnaissance scenarios as shown in the usage examples.
Can enumerate all JavaScript files across an entire domain with the -d flag, enabling broad security assessments without manual file hunting.
Provides HTML output for visual inspection and plaintext for fast CLI/STDOUT use, with the plaintext mode skipping jsbeautifier for speed.
Only extracts endpoints from JavaScript files, missing potential endpoints in HTML, CSS, or other web sources, which reduces coverage in full-scope tests.
Requires argparse and jsbeautifier installation via pip, adding setup complexity and potential version conflicts in some Python environments.
Supports cookies with the -c flag but lacks advanced session management, making it less effective for endpoints requiring login or tokens without manual workarounds.