mcpField
G
gau-urlfetch

gau-urlfetch

github.com/wgpsecSecurity1.8k42 installsUpdated 4d ago
Repository

About gau-urlfetch

A guide to using gau for passive URL collection from historical sources. It is aimed at security testers who want to gather known URLs and filter them through command-line pipelines.

Key features

  1. 01Aggregate Wayback, CommonCrawl, OTX, and URLScan
  2. 02Collect known URLs passively
  3. 03Select providers and date ranges
  4. 04Filter results in command pipelines

Use cases

  1. 01Gather historical URLs for a domain and its subdomains
  2. 02Find parameterized URLs for further testing
  3. 03Identify JavaScript files and API paths

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/wgpsec/aboutsecurity --skill gau-urlfetch

After installing, type/gau-urlfetchin Claude Code to confirm it loaded.

Details

From the project README

gau URL 历史收集方法论

gau (getallurls) 从历史数据源收集已知 URL。核心优势：四大数据源聚合（Wayback/CommonCrawl/OTX/URLScan）+ 纯被动 + 管道友好。

项目地址：https://github.com/lc/gau

Phase 1: 基本使用

# 收集目标域名的所有已知 URL
gau target.com

# 包含子域名
gau --subs target.com

# 输出到文件
gau target.com -o urls.txt

# 过滤静态资源
gau --blacklist png,jpg,gif,svg,woff,ttf,ico,css target.com

Phase 2: 数据源控制

# 指定数据源
gau --providers wayback target.com
gau --providers wayback,commoncrawl target.com

# 时间范围
gau --from 202301 --to 202612 target.com

# 控制线程
gau --threads 10 target.com

# 从 stdin
echo target.com | gau
cat domains.txt | gau

Phase 3: 管道集成

# URL 收集 → 提取带参数的 URL → XSS 扫描
gau target.com | grep "=" | sort -u | dalfox pipe --silence

# URL 收集 → 提取 JS 文件
gau target.com | grep "\.js$" | sort -u

# URL 收集 → 提取 API 端点
gau target.com | grep -E "/api/|/v[0-9]/" | sort -u

# URL 收集 → 存活检测
gau target.com | httpx -silent

# URL 收集 → 敏感路径
gau target.com | grep -iE "admin|backup|config|\.env|\.git|debug"

常用场景速查

场景命令
全量收集gau --subs target.com -o all_urls.txt
参数URLgau target.com | grep "=" | sort -u
JS 文件gau target.com | grep "\\.js$" | sort -u
API 发现gau target.com | grep -E "/api/" | sort -u

Comments

Markdown supported