R-LIN
LinkFinder
Python tool that extracts endpoints and URLs from JavaScript files to expand a web application's attack surface.
OVERVIEW
LinkFinder (github.com/GerbenJavado/LinkFinder) is a Python tool built around a single regular expression tuned to pull URLs and endpoint-shaped strings out of JavaScript source, whether it's a single file, a live page, or a whole directory of bundled/minified JS. It can run standalone against a JS file or URL, or be pointed at a domain to crawl and pull JS files automatically before extracting.
Modern web apps route far more logic through client-side JavaScript than through server-rendered HTML, so a crawler alone routinely misses API paths, internal endpoints, or feature-flagged routes that only ever appear as a string inside a JS bundle — LinkFinder's whole job is surfacing those strings so they can be added to the tested attack surface.
USE CASES
Practical use cases
- 01
Extracting API endpoints and internal paths referenced only inside a page's JavaScript bundles.
- 02
Expanding a web app's tested attack surface beyond what a standard crawler discovers from rendered HTML.
- 03
Surfacing parameter names and route patterns worth targeting for further parameter or endpoint fuzzing.
- 04
Reviewing minified/bundled JS for hardcoded internal hostnames or staging/debug endpoints.
QUICK START
After crawling a web app, to mine its JavaScript bundles for endpoints and paths that never show up in the rendered HTML or a standard crawl.
- Confirm downloading and analyzing the target's client-side JavaScript is within the authorized scope.
- Install LinkFinder and its Python dependencies (jsbeautifier) from the GitHub repo.
- Run it against a single JS file, a live page URL, or a whole domain to crawl.
- Review the extracted endpoints in the HTML/CLI output for paths worth investigating further.
- Feed interesting endpoints into further enumeration (parameter discovery, auth checks) with other tools.
python3 linkfinder.py -i https://target.example.com -d -o cliBEFORE YOU RUN IT
What to check before running it
It's a regex-based extractor, not a JavaScript parser — expect false positives (strings that look like paths but aren't) and occasional misses on heavily obfuscated code, so review results manually before acting on them.
Crawling a full domain (-d) to gather JS files generates real HTTP traffic against the target — confirm crawl volume and rate are within scope.
An extracted endpoint isn't automatically in scope or exploitable — confirm it belongs to the tested application (not a third-party CDN/library) before probing it further.