Wayback URL Extractor - Free Recon & Discovery tool

What is Wayback URL Extractor?

Wayback URL Extractor pulls every URL that the Internet Archive and AlienVault OTX have ever seen for a domain, then mines that list for the testable surface: parameter names, file extensions, sensitive backups, deep API paths, dangerous-parameter URLs, and tokens or secrets embedded in query strings.

Old URLs are gold for testers. They reveal forgotten parameters, deprecated API routes and legacy files that often still work and are rarely patched. This tool does not just dump the list, it extracts the high-value subset and presents it with one-click filtering.

What it does

Historical URL aggregation from Wayback Machine and AlienVault OTX, with per-source status and timing reported back.
Batch input up to 3 domains, IDN/unicode accepted, optional date range.
Parameter mining with unique names, frequency, and risky-name flagging (open-redirect, SSRF, LFI candidates).
Dangerous-URL highlighting in the list, plus a dedicated view of just those URLs.
Tokens in URLs view: scans every URL for JWT, AWS signed URLs, Google / Stripe / Slack / GitHub / Twilio API keys, session cookies, emails, internal IPs and Base64 blobs.
Sensitive-file detection for .sql, .env, .bak, .config, .log, .pem, .key and 20+ other extensions, with per-extension quick-filter chips.
Endpoint pattern grouping: `/users/1`, `/users/2` and `/users/3` collapse into `/users/{id}` so you test one URL per pattern instead of N.
Advanced filtration: 7 pre-built presets (API / Admin / Auth / Upload / Search / Redirect / Debug), multi-extension picker, path-depth filter, host-pattern wildcard, query-value search, regex with `-exclude` and `danger:` prefix, save and load filter combos.
Parameterized URLs view shows the real archived values, with an optional toggle to flip to a FUZZ template ready for ffuf.
Export and handoff: per-row archive replay, copy URL, copy as ffuf, .txt / .csv / .md downloads, one-click handoff to URL Extractor, SiteMapper, HTTP ProbeMaster, Subdomain Discovery and Vulnerability Scanner.

Where it fits in your workflow

→Find forgotten parameters and deep API paths on a target that are no longer linked from the live site.
→Hunt for leaked .env, .bak, .sql, .config or private-key files that the archive captured and that may still resolve.
→Discover tokens or secrets accidentally stored in archived query strings (JWTs, AWS signatures, API keys).
→Seed a fuzzing run with real previously-valid endpoints, then flip to the FUZZ template view to hand off to ffuf or Burp Intruder.
→Use the date range to find URLs that appeared after a specific launch, or only fresh recent captures.

Use Wayback URL Extractor

Run it from your dashboard.

Create free account Sign in Use via API

At a glance

CategoryRecon & Discovery

RunsServer-side

Token cost 4 / run (free tier)

Access Pro

Status● Live

Frequently asked questions

Why are some URLs dead?

These are historical snapshots, so many will 404 today. That is the point: test which old endpoints still respond, as they are frequently left unpatched. Use the “Status 200 only” toggle to focus on captures that were live at archive time.

Does this make HTTP requests to my target?

No. Every query goes to the Internet Archive and AlienVault OTX. Token scanning and pattern grouping are all regex operations on the URL strings, with no live probing of your target.

How does the “Tokens in URLs” view work?

Each URL is regex-scanned for known token formats (JWT, AWS signed URL, Google / Stripe / Slack / GitHub / Twilio API keys, session cookies in URLs, emails, internal IPv4 addresses, long Base64 blobs). Findings are severity-tagged and grouped by type.

What is the FUZZ template toggle?

The Parameterized URLs view shows real archived URLs by default. Toggle “Show as FUZZ template” to replace every query value with FUZZ and de-duplicate the result, which is the format your fuzzer wants.