Ultimate LinkFinder Cheat Sheet

A reference guide for discovering endpoints in JavaScript files. Extract hidden URLs and API routes.

Jump To Section

• Basic Syntax
• File Analysis
• Output & Options
• Pipeline Integration
• Advanced Usage
• Burp Suite Integration

1. Basic Syntax

The fundamental structure of a LinkFinder command.

python linkfinder.py -i [input] -o [output] [options]

Essential Flags

• -i, --input [FILE] : Input file/URL
• -o, --output [FILE] : Output file
• -d, --domain [DOMAIN] : Domain to search
• -b, --burp : Burp Suite output

Basic Usage

• python linkfinder.py -i script.js : Analyze file
• python linkfinder.py -i https://example.com/app.js : Remote file
• python linkfinder.py -i script.js -o results.html : HTML output
• python linkfinder.py -i script.js -d example.com : Filter domain

Pro Tip: Installation
Install requirements: pip install -r requirements.txt. Requires Python 3.6+ and beautifulsoup4, requests, and selenium packages.

2. File Analysis

Analyze Local File

Extract endpoints from local JavaScript file.

python linkfinder.py -i /path/to/script.js

Analyze Remote File

Extract endpoints from remote JavaScript file.

python linkfinder.py -i https://example.com/js/main.js

Analyze Multiple Files

Process multiple JavaScript files.

for js in $(find . -name "*.js"); do python linkfinder.py -i $js -o results.html; done

Analyze with Regex

Use custom regex pattern to find endpoints.

python linkfinder.py -i script.js -r "/api/v[0-9]+/"

Analyze Inline Scripts

Extract endpoints from HTML with inline scripts.

python linkfinder.py -i page.html -d

Complete Analysis

Run with all analysis options enabled.

python linkfinder.py -i script.js -d -r "/api/" -o results.html

Pro Tip: JavaScript Collection
Use waybackurls to find historical JS files: waybackurls example.com | grep "\.js$" | sort -u | while read url; do python linkfinder.py -i $url; done

3. Output & Options

HTML Output

Generate HTML report with clickable links.

python linkfinder.py -i script.js -o results.html

Console Output

Print results to console (default).

python linkfinder.py -i script.js -o cli

Domain Filter

Only show endpoints matching domain.

python linkfinder.py -i script.js -d example.com

Custom Regex

Use custom regex for endpoint discovery.

python linkfinder.py -i script.js -r "/api/v[0-9]+/[a-z]+"

Include Cookies

Send cookies for authenticated pages.

python linkfinder.py -i https://example.com/app.js -c "session=abc123"

Verbose Output

Show detailed analysis information.

python linkfinder.py -i script.js -v

Output Flag	Description
-o, --output [FILE]	Save results to file
-o cli	Console output
-d, --domain [DOMAIN]	Filter by domain
-r, --regex [REGEX]	Custom regex pattern
-c, --cookies [COOKIE]	Send cookies
-v, --verbose	Verbose output

4. Pipeline Integration

With Waybackurls

Analyze historical JavaScript files.

waybackurls example.com | grep "\.js$" | sort -u > js-files.txt; while read url; do python linkfinder.py -i $url; done < js-files.txt

With HTTPx

Check if discovered endpoints are alive.

python linkfinder.py -i script.js -o cli | httpx -sc -title -silent

With Nuclei

Scan discovered endpoints for vulnerabilities.

python linkfinder.py -i script.js -o cli | nuclei -t exposures/ -silent

With Ffuf

Fuzz discovered API endpoints.

python linkfinder.py -i script.js -o cli | grep "api" | ffuf -w - -u FUZZ -mc 200

With SQLmap

Test discovered endpoints for SQL injection.

python linkfinder.py -i script.js -o cli | grep "=" | sqlmap -m -

Full JS Analysis Pipeline

Complete JavaScript endpoint discovery workflow.

waybackurls example.com | grep "\.js$" | sort -u | while read url; do python linkfinder.py -i $url -o cli; done | sort -u | httpx -silent

Pro Tip: Automation Script
Create a bash script that automates the entire workflow: collect JS files → run LinkFinder → deduplicate → validate with HTTPx → scan with Nuclei.

5. Advanced Usage

Custom User-Agent

Set custom user agent for requests.

python linkfinder.py -i https://example.com/app.js -H "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

Complete HTML Report

Generate comprehensive HTML report.

python linkfinder.py -i script.js -d -o report.html

Analyze with Custom Regex

Find specific API patterns.

python linkfinder.py -i script.js -r "/api/v[0-9]+/[a-zA-Z0-9/_]+"

Extract All Endpoints

Run with all extraction methods enabled.

python linkfinder.py -i script.js -d -r "/api/|/admin/|/internal/" -o results.html

Process JS from Source Maps

Analyze source map files for endpoints.

python linkfinder.py -i app.js.map -o cli

Batch Processing

Process all JS files in directory.

find . -name "*.js" -exec python linkfinder.py -i {} -o cli \;

Advanced Flag	Description
-H, --headers	Custom headers
-r, --regex	Custom regex pattern
-d, --domain	Domain filter
-c, --cookies	Cookie support
-v, --verbose	Verbose mode

6. Burp Suite Integration

Export Burp Format

Generate Burp Suite compatible output.

python linkfinder.py -i script.js -b -o burp-results.html

Import to Burp

Import results into Burp Suite.

Burp Suite → Target → Site map → Import → Select HTML file

Burp Extension

Use LinkFinder as Burp extension.

Burp Suite → Extender → BApp Store → Search "LinkFinder"

Passive Scanning

Automatically analyze JS files in Burp.

Burp Suite → Proxy → Options → Response Modification → Enable LinkFinder

Custom Burp Workflow

Complete Burp + LinkFinder workflow.

1. Browse target in Burp → 2. Collect JS files → 3. Export URLs → 4. Run LinkFinder → 5. Import results

Pro Tip: Burp Extension Benefits
The Burp Suite extension automatically processes JavaScript files as you browse, finding endpoints in real-time. Results appear in the "LinkFinder" tab and can be sent to other tools.

Export Endpoints from Burp

Extract endpoints from Burp history.

Burp Suite → Proxy → HTTP History → Filter: JavaScript → Right-click → Save items → Analyze with LinkFinder

Burp Integration	Description
-b, --burp	Generate Burp compatible output
BApp Store	Install as Burp extension
Passive Scanning	Auto-analyze JS files
Site Map Import	Import results to site map

⇧