Arsenly
Tools
Recon & Discovery16 tools Web Security Audit10 tools Exploitation & OOB3 tools Payloads & Wordlists4 tools Cryptography & Generators3 tools Encoders & Converters5 tools Reference & Reports4 tools
Browse the full catalogue Open /explore →
Free Tools
Recon & Discovery
SiteMapper ProTurn a URL list into 4 views: hierarchical host/path tree, sortable fl… URL & Endpoint ExtractorMine URLs, JS endpoints, domains and parameters from pasted source cod… CIDR / IP CalculatorIPv4 and IPv6 subnet math. Expand CIDRs, parse ranges and netmasks, ag…
Web Security Audit
Cookie / JWT AuditorAudit cookie flags (Secure, HttpOnly, SameSite, __Host- / __Secure- pr… OpenAPI / Swagger AnalyzerPaste or drop an OpenAPI 3 / Swagger 2 spec and map its attack surface…
Cryptography & Generators
Hash ToolkitGenerate (MD5, NTLM, SHA) and identify 60+ hash types with ranked cand… Test Data GeneratorRealistic-looking test data across 22 countries: names, emails, phone … Code / Password / Token GeneratorCustom-charset strings (1-512 chars, up to 5000 at a time), passwords …
Encoders & Converters
Encoder / Decoder4-tab workbench: 20+ encodings (URL, double-URL, percent-all, Base64, … HTTP Request ConverterConvert HTTP requests between 6 formats: Raw HTTP (Burp), curl, fetch(… JSON WorkbenchFormat, validate (with line / col error), minify, sort keys, unescape … Text Suite7-tab text workbench: regex find/replace, sort/dedupe/sample, keep-dro… Text Comparer4-tab diff workbench: true LCS line / word / char diff, side-by-side, …
See all 13 free tools on /explore →
Pricing
Resources
ChangelogWhat's shipped lately API DocsAutomate scans from your CLI About XowiaLabsWho's behind this ContactBug reports, ideas, just say hi Terms & PrivacyAcceptable-use policy + privacy
Sign in Get started
← All tools

URL & Endpoint Extractor

Recon & Discovery Free · No sign-up

Mine URLs, hidden JS endpoints, domains, parameters and leaked secrets from any source - paste it, load a file, or fetch a remote JS.

Try it now No sign-up required. Runs entirely in your browser.

Paste or load content for instant in-browser extraction - or fetch a remote file (e.g. a JS bundle) by its URL.

Paste source, load a file, or fetch a URL - then Extract to mine
URLs, JS endpoints, domains, parameters and leaked secrets.

What is URL & Endpoint Extractor?

URL Extractor turns a blob of HTML / JavaScript / logs into structured recon. Beyond absolute URLs, it pulls out relative API endpoints hidden in JS (the LinkFinder workflow), the domains and query parameters referenced, sensitive files, and scans for leaked secrets (API keys, tokens, JWTs, private keys).

Extraction runs entirely in your browser. Optionally, the tool can fetch a remote file (e.g. a target’s main.js) server-side - SSRF-guarded and size-capped - so you can mine it without CORS getting in the way.

What it does

  • URLs & JS endpoints - absolute links plus relative API paths buried in JavaScript.
  • Secret scanning - flags AWS / Google / GitHub / Stripe / Slack keys, JWTs, bearer & api-key assignments and private keys.
  • Domains & parameters - every host and query-parameter name referenced.
  • Sensitive files - surfaces .env / .sql / .bak / key / config references.
  • Fetch remote files - pull a target’s JS/HTML (SSRF-guarded, 3 MB cap) and extract from it.
  • Filter & export - category chips, regex filter, per-view copy/download, pivots to SiteMapper / ProbeMaster / Vulnerability Scanner.

Where it fits in your workflow

  • →Mine a JavaScript bundle for hidden API endpoints and hard-coded secrets.
  • →Pull every domain/subdomain and parameter referenced in a page or app.
  • →Feed the endpoint list straight into ProbeMaster or the Vulnerability Scanner.
Want more?

This one is free in your browser. Sign up for server-side recon, scan history, and projects.

Create free account Sign in

At a glance

CategoryRecon & Discovery
RunsIn your browser
Token cost Free - no tokens
Access No login needed
Status● Live

Frequently asked questions

Where does extraction happen?

In your browser - pasted/loaded content never leaves your machine. Only the optional “Fetch URL” uses the server (SSRF-guarded) to retrieve a remote file, which is then extracted client-side.

Are the detected secrets verified?

No - they are pattern matches and may include false positives. Confirm a key is live with the KeyHacks tool before reporting.

Other free tools you might like

Encoder / Decoder

4-tab workbench: 20+ encodings (URL, double-URL, percent-all, Base64, Base64URL, HTML, JS \xXX / \uXXXX, CSS, Hex, Binary, Octal, ASCII, ROT-N, Atbash, Morse), all-encodings multi-view, hashes (MD5, SHA family, HMAC), and Unix-timestamp / ISO 8601 conversions.
Test Data Generator

Realistic-looking test data across 22 countries: names, emails, phone numbers (fiction-reserved ranges), addresses, postal codes and format-valid sample IDs. Safety-reserved ranges so values look real but never collide with live data. Cards, text, JSON and CSV export.
SiteMapper Pro

Turn a URL list into 4 views: hierarchical host/path tree, sortable flat list, pattern-frequency (collapses /users/1, /users/2 to /users/{id}) and per-host stats. 10 categories (API, Auth, Params, JS, Sensitive paths/files, Backups, Documents, JSON/XML). Advanced filter (regex, exclude, host pattern, depth), saved lists and one-click handoff to ProbeMaster, Takeover and more.
Explore more tools →