Waybackurls Command Guide

Waybackurls (by TomNomNom) fetches all the URLs that the Wayback Machine knows about for a domain.

Top 10 Useful Commands

1. Basic Usage

echo example.com | waybackurls

Explanation: Fetch everything for domain.

2. Include Subdomains

echo example.com | waybackurls -no-subs

Explanation: (Confusion: default usually gets subs if wildcarded, tool is simple). Note: Default gets known URLs.

3. User Filter

# Pipe to grep
echo example.com | waybackurls | grep "admin"

Explanation: Filter for admin paths.

4. Extensions

echo example.com | waybackurls | grep ".js"

Explanation: Find JS files.

5. Parameters

echo example.com | waybackurls | grep "="

Explanation: Find URLs with potential parameters (SQLi/XSS targets).

6. Unique

echo example.com | waybackurls | sort -u

Explanation: Remove duplicates.

7. Save

echo example.com | waybackurls > urls.txt

Explanation: Save to file.

8. Check Alive

echo example.com | waybackurls | httprobe

Explanation: Check which old URLs are still working.

9. Get Parameters Only (Unfurl)

echo example.com | waybackurls | unfurl keys

Explanation: (With Unfurl tool) Extract parameter names.

10. JSON (if supported)

echo example.com | waybackurls -json

(Older versions are text only)

The Most Powerful Command

echo target.com | waybackurls | sort -u | grep "=" | qsreplace "FUZZ" | freq

Explanation: Get all URLs, filter for params, replace values with FUZZ (ready for testing), and check frequency.