Waybackurls Tool for Discovering Archived URLs

Waybackurls is a lightweight command-line tool that retrieves URLs recorded by the Internet Archive’s Wayback Machine for a specified domain. Developed by Tom Hudson (tomnomnom), it helps security researchers, penetration testers, and web administrators discover historical URLs associated with a website.

The tool accepts line-delimited domains through standard input, queries the Wayback Machine for archived URLs associated with each domain and its subdomains, and prints the results to standard output. This makes it easy to incorporate historical URL discovery into reconnaissance workflows and combine the output with other command-line utilities.

How Waybackurls Works

Websites change over time. Pages are removed, application routes are updated, and older resources may no longer appear in a site’s current navigation. However, the Internet Archive may retain records of URLs that were publicly accessible in the past.

Waybackurls retrieves these historical URL records for a supplied domain. Its output can reveal previously indexed pages, legacy application paths, old API endpoints, and resources that are no longer linked from the live website.

The tool focuses on collecting URL information rather than testing whether every discovered endpoint is currently accessible. Archived URLs should therefore be treated as historical references, not confirmation that a resource still exists.

Installing Waybackurls

Waybackurls is written in Go and can be installed using the Go toolchain. Make sure Go is installed and configured on your system before proceeding.

go install github.com/tomnomnom/waybackurls@latest

The original project also documents the older installation command:

go get github.com/tomnomnom/waybackurls

For current Go versions, the go install approach is generally preferred for installing command-line applications. Ensure that your Go binary directory is included in the system’s PATH so the waybackurls command can be executed from the terminal.

Using Waybackurls to Collect Archived URLs

The tool reads domains from standard input, allowing researchers to process a single domain or a list of domains stored in a text file.

For example, create a file named domains.txt containing one domain per line. Run the following command to retrieve archived URLs and save the output:

cat domains.txt | waybackurls > urls.txt

This command performs three basic operations:

• Input: Reads line-delimited domain names from domains.txt.
• Collection: Queries the Wayback Machine for known URLs associated with those domains and their subdomains.
• Output: Writes the collected URLs into urls.txt for further analysis.

You can also provide a domain directly through standard input:

echo example.com | waybackurls

The resulting URL list can be reviewed manually or processed with other tools. For example, sorting the output helps remove duplicate entries:

cat urls.txt | sort -u

Security Research and Reconnaissance Applications

Historical URL discovery can provide useful context during authorized security assessments. Older URLs may point to discontinued features, legacy application routes, forgotten documentation, or endpoints that are not immediately visible on the current website.

Security teams can use these records to:

• Expand the list of known web application paths during attack surface mapping.
• Identify historical API routes that may need review.
• Compare archived URL structures with the current application.
• Find references to older site sections and discontinued resources.
• Support asset inventory and website migration reviews.

Archived URLs do not automatically indicate vulnerabilities. Any discovered endpoint should be verified through authorized testing, and sensitive information should be handled according to the assessment’s rules of engagement.

Combining Waybackurls With Other Security Tools

Waybackurls works well in command-line pipelines because it uses standard input and output. Researchers can save its results, remove duplicates, and pass the collected URLs into additional analysis tools.

For broader web reconnaissance, tools such as WhatWeb can help identify technologies used by accessible web applications. Combining historical URL records with current technology information can provide a more complete picture of a website’s exposed infrastructure.

Keep in mind that results depend on what the Internet Archive has collected. Recently created pages, unarchived resources, and URLs excluded from archiving may not appear in the output.

Waybackurls Project and Download

Waybackurls provides a simple way to retrieve historical URLs without manually searching through the Wayback Machine. Its standard-input workflow makes it useful for repeatable reconnaissance tasks, domain inventory checks, and authorized web application assessments.

Visit the official GitHub repository for the source code, documentation, and project information:

Download Waybackurls from GitHub