Ultimate Waybackurls Cheat Sheet

A reference guide for extracting historical URLs from the Wayback Machine. Uncover hidden endpoints and old files.

Jump To Section

• Basic Syntax
• Input & Output
• Filtering & Processing
• Pipeline Integration
• Advanced Usage
• Companion Tools

1. Basic Syntax

The fundamental structure of a Waybackurls command.

waybackurls [domain] [options]

Input Methods

• waybackurls example.com : Single domain
• cat domains.txt | waybackurls : Pipe domains
• waybackurls -d example.com : Domain flag
• echo "example.com" | waybackurls : Echo pipe

Basic Usage

• waybackurls example.com : Basic fetch
• waybackurls example.com -o urls.txt : Save output
• waybackurls -l domains.txt : List input
• waybackurls example.com -no-subs : No subdomains

Pro Tip: Subdomain Discovery
By default, waybackurls includes all subdomains. Use -no-subs flag to limit results to only the specified domain without subdomains.

2. Input & Output

Single Domain

Fetch all URLs for a single domain.

waybackurls example.com

Multiple Domains

Process multiple domains from file.

waybackurls -l domains.txt

Save Results

Save output to a file.

waybackurls example.com -o urls.txt

Append to File

Append results to existing file.

waybackurls example.com >> all-urls.txt

Pipe Input

Pipe domains from stdin.

cat domains.txt | waybackurls

Silent Mode

Output only URLs without errors.

waybackurls example.com 2>/dev/null

Input/Output Flag	Description
-l, --list [FILE]	Read domains from file
-o, --output [FILE]	Save results to file
-d, --domain	Domain to fetch
-no-subs	Exclude subdomains
-dates	Include dates with URLs
-get-versions	Get all URL versions

3. Filtering & Processing

Filter for Interesting Extensions

Extract URLs with specific file extensions.

waybackurls example.com | grep -E "\.(php|asp|aspx|jsp|json|xml|js)$"

Filter for Parameters

Find URLs with query parameters.

waybackurls example.com | grep "?"

Filter for Interesting Paths

Discover admin, login, and API endpoints.

waybackurls example.com | grep -E "(admin|login|api|upload|backup|config)"

Remove Duplicates

Sort and remove duplicate URLs.

waybackurls example.com | sort -u

Extract Unique Paths

Get unique directory paths.

waybackurls example.com | sed 's/?.*//' | sort -u

Filter by Status Code

Filter URLs that return specific status codes.

waybackurls example.com | httpx -mc 200 -silent

Pro Tip: Extension Hunting
Focus on sensitive extensions: .bak, .old, .backup, .sql, .zip, .tar.gz, .env, .conf. These often contain sensitive information.

4. Pipeline Integration

With HTTPx

Check which URLs are still alive.

waybackurls example.com | httpx -sc -title -silent

With Nuclei

Scan historical URLs for vulnerabilities.

waybackurls example.com | nuclei -t cves/ -silent

With SQLmap

Test historical URLs for SQL injection.

waybackurls example.com | grep "?" | sqlmap -m -

With Gf Patterns

Extract URLs matching common vulnerability patterns.

waybackurls example.com | gf sqli

With Ffuf

Fuzz discovered paths for hidden files.

waybackurls example.com | sed 's/?.*//' | ffuf -w - -u FUZZ -mc 200

Full Recon Pipeline

Complete historical URL analysis.

waybackurls example.com | grep "=" | httpx -silent | nuclei -t exposures/ -o results.txt

Pro Tip: Automation Scripts
Create bash scripts that combine waybackurls with other tools for automated recon. Example: Fetch URLs → Filter for parameters → Test for SQLi → Save results.

5. Advanced Usage

Include Dates

Show dates when URLs were archived.

waybackurls example.com -dates

Get All Versions

Retrieve all historical versions of URLs.

waybackurls example.com -get-versions

No Subdomains

Exclude subdomains from results.

waybackurls example.com -no-subs

Multiple Domains with Output

Process multiple domains and save results.

cat domains.txt | waybackurls | tee all-urls.txt

Extract JavaScript Files

Find JavaScript files for further analysis.

waybackurls example.com | grep "\.js$" | sort -u

Find API Endpoints

Discover API endpoints from historical data.

waybackurls example.com | grep -i "api" | sort -u

Extract Sensitive Files

Find backup, config, and sensitive files.

waybackurls example.com | grep -E "\.(bak|backup|old|sql|zip|tar|gz|env|conf|config)$"

Advanced Flag	Description
-dates	Show archive dates
-get-versions	Get all URL versions
-no-subs	Exclude subdomains
-l [FILE]	Read from file
-o [FILE]	Write to file

6. Companion Tools

Gf (Grep Framework)

Pattern-based filtering for URLs.

waybackurls example.com | gf xss

Qsreplace

Replace query string values for fuzzing.

waybackurls example.com | grep "=" | qsreplace "FUZZ"

Unfurl

Extract and visualize URL components.

waybackurls example.com | unfurl paths

Uro

Deduplicate URLs by removing parameter values.

waybackurls example.com | uro

Kxss

Find reflected XSS candidates.

waybackurls example.com | grep "=" | kxss

Dalfox

Advanced XSS scanning on discovered URLs.

waybackurls example.com | grep "=" | dalfox pipe

Tool	Purpose	Usage
gf	Pattern filtering	gf [pattern]
qsreplace	Replace query values	qsreplace [value]
unfurl	URL parsing	unfurl [key]
uro	URL deduplication	uro
kxss	XSS detection	kxss
dalfox	XSS scanning	dalfox pipe

Pro Tip: Tool Installation
Install companion tools with Go: go install github.com/tomnomnom/gf@latest, go install github.com/tomnomnom/qsreplace@latest, go install github.com/tomnomnom/unfurl@latest.

⇧