gau

Fetch URLs for domain

$ gau [example.com]

$ gau [example.com] -o [urls.txt]

$ gau --providers [wayback,otx] [example.com]

$ gau --subs [example.com]

$ gau --from [202201] --to [202212] [example.com]

gau [options] domains...

gau (Get All URLs) fetches known URLs for domains from multiple sources including Wayback Machine, Common Crawl, and AlienVault OTX. It's used for reconnaissance and security research.
The tool aggregates historical URLs that may reveal hidden endpoints, parameters, or old vulnerabilities. Results include archived pages, API endpoints, and file paths.
gau enables discovering attack surface by finding URLs that were once publicly accessible.

DOMAINS

Target domains to fetch URLs for.

Output file.

URL sources: wayback, otx, commoncrawl.

Include subdomains.

Start date (YYYYMM).

End date (YYYYMM).

Display help information.

Results include historical dead URLs. May produce large output. Subject to source rate limits.

gau was created for security research and bug bounty hunting, providing easy access to archived URL databases for reconnaissance purposes.

waybackurls(1), hakrawler(1), gospider(1)