{
  "slug": "endpoint-discovery",
  "title": "Endpoint Discovery",
  "phase": "Enumeration",
  "description": "Uncover hidden routes, API endpoints, and web resources by combining passive URL harvesting with active directory brute-forcing and JavaScript analysis.",
  "difficulty": "medium",
  "tags": [
    "mapping",
    "web",
    "api",
    "directory-brute-force",
    "js-analysis",
    "historical-urls"
  ],
  "tools": [
    "gau",
    "waybackurls",
    "katana",
    "feroxbuster",
    "ffuf",
    "gospider",
    "linkfinder"
  ],
  "steps": [
    {
      "id": "endpt-01",
      "title": "Historical URL harvesting",
      "description": "Pull URLs from the Wayback Machine, Common Crawl, and other passive sources.",
      "commands": [
        "gau --threads 5 target.com | tee gau-urls.txt",
        "waybackurls target.com >> gau-urls.txt",
        "sort -u gau-urls.txt -o historical-urls.txt"
      ],
      "notes": "Historical URLs often reveal deprecated API versions, internal paths, and files that were never meant to be public."
    },
    {
      "id": "endpt-02",
      "title": "Active crawling",
      "description": "Spider live pages to discover endpoints that passive sources miss.",
      "commands": [
        "katana -u https://target.com -depth 3 -js-crawl -o katana-urls.txt",
        "gospider -s https://target.com -d 3 -o gospider-out/"
      ]
    },
    {
      "id": "endpt-03",
      "title": "Directory and path brute-force",
      "description": "Brute-force common paths and directories using curated wordlists.",
      "commands": [
        "feroxbuster -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,html,js,json,xml -o ferox-out.txt",
        "ffuf -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt -mc 200,301,302,403 -o ffuf-out.json"
      ],
      "notes": "Filter by response size and content type to cut down false positives. Use -fc to exclude known noise."
    },
    {
      "id": "endpt-04",
      "title": "JavaScript endpoint extraction",
      "description": "Parse JavaScript files to extract hardcoded API routes, secrets, and internal endpoints.",
      "commands": [
        "cat historical-urls.txt katana-urls.txt | grep '\\.js$' | sort -u > js-files.txt",
        "cat js-files.txt | while read url; do python3 linkfinder.py -i $url -o cli; done",
        "nuclei -l js-files.txt -t exposures/tokens/ -o js-secrets.txt"
      ]
    },
    {
      "id": "endpt-05",
      "title": "Parameter discovery",
      "description": "Fuzz discovered endpoints for hidden query parameters.",
      "commands": [
        "cat historical-urls.txt | unfurl keys | sort -u > known-params.txt",
        "ffuf -u 'https://target.com/api/users?FUZZ=test' -w known-params.txt -mc 200 -o param-fuzz.json",
        "arjun -u https://target.com/api/users -oJ arjun-params.json"
      ]
    }
  ],
  "references": [
    "https://github.com/lc/gau",
    "https://github.com/projectdiscovery/katana",
    "https://github.com/epi052/feroxbuster",
    "https://github.com/ffuf/ffuf",
    "https://github.com/GerbenJavado/LinkFinder"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-04-04"
}