Skip to content
Deepak Gupta markRecon Atlas

URL and endpoint discovery

URLFinder

Passive URL discovery tool from ProjectDiscovery that gathers a domain's known URLs from public archives and intel sources.

PassiveScope a pentestAudit your own exposureResearch a competitor

921 stars · last push November 9, 2026 · v0.0.3 · MIT

GitHub repository

What it finds

URLFinder collects URLs for a target domain from curated passive sources without active scanning. Sources include the Wayback Machine, Common Crawl and AlienVault, and each can be selected or excluded. Output can be filtered by pattern and written as JSONL with the source of each URL.

  • URLs
  • endpoints
  • historical paths

Does it touch the target?

Reads third-party sources only. Sends no traffic to the target's systems.

README: "A high-speed tool for passively gathering URLs, optimized for efficient web asset discovery without active scanning." JSONL output tags each URL with its source, e.g. "waybackarchive".

API keys: The README documents a provider config file (-pc); the project's source code marks VirusTotal and URLScan as needing keys and AlienVault, Common Crawl and Wayback as keyless.

Install

Install with go
go install -v github.com/projectdiscovery/urlfinder/cmd/urlfinder@latest

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Enumerate URLs for a domain
urlfinder -d example.com

From the project's documentation

Keep only URLs matching patterns
urlfinder -d example.com -m shop,model

From the project's documentation

Match one pattern and exclude another
urlfinder -d example.com -m support -f faq

From the project's documentation

JSONL output with the source of each URL
urlfinder -d example.com -j

From the project's documentation

Output formats: stdout, file, JSONL

Limits the project documents

  • Using all sources (-all) "may be slower".
  • Enumeration stops at a default max time of 10 minutes (-max-time).
  • Requires Go 1.26.10 to install from source.

Deepak's take

Analysis, not documentation

Use it when
Use it for passive URL collection when you already run other ProjectDiscovery tools and want matching flags, scope rules and JSONL output.
Skip it when
Skip it when you need the live state of the site; archived URLs can be stale. Katana covers current pages.
What it will miss
It sees only what its archive and intel sources recorded, never the target's unlinked or newly added endpoints.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Listed under GitHub's reconnaissance topic. Licence: MIT. URLFinder is a trademark or project name of its owners; this library is not affiliated with it.