OSINT for the Lazy Part 18: Extracting Value from Wayback Machine Archives for Bug Bounty and Security Research
The article examines how OSINT practitioners can leverage web archives for practical security research, particularly in bug bounty programs. Among the many available tools, those that query historical snapshots of websites stand out for their ability to reveal forgotten resources without active scanning.
Common findings from archived copies include old API endpoints, admin and test panels such as /admin, /test, and /debug, configuration and backup files with extensions like .bak, .sql, .old, and .git, as well as JavaScript files containing sensitive parameters or hardcoded keys. Outdated versions of applications may also expose vulnerabilities that have since been patched in the live site.
The primary advantage of this approach is its passive nature: queries are made only against public archives, so the target organization receives no direct requests and detection risk remains minimal.
waybackurls
waybackurls, developed by tomnomnom, is a lightweight Go utility that pulls every indexed URL for a given domain from the Wayback Machine CDX API. It supports subdomains and reveals parameters that can later be tested for issues such as IDOR, open redirect, LFI, and XSS. Installation requires Go and is performed with a single command: go install github.com/tomnomnom/waybackurls@latest.
gau (getallurls)
gau, created by lc, extends coverage by querying four sources simultaneously: Wayback Machine, Common Crawl, AlienVault OTX, and URLScan. It accepts domains via stdin or arguments, supports multiple targets, and offers rich filtering flags including --blacklist, --fc, --mc, --from, --to, and --providers. Installation command: go install github.com/lc/gau/v2/cmd/gau@latest.
waymore
For users preferring Python, waymore by xnl_h4ck3r provides the widest coverage and the ability to download full archived responses. It supports additional sources including VirusTotal, GhostArchive, and Intelligence X. While slower than the Go tools, it excels at retrieving content that can be further analyzed with tools such as xnLinkFinder or trufflehog for secrets and additional links.
Security researchers are encouraged to combine these utilities according to their needs: waybackurls or gau for quick results and waymore when maximum coverage and archived content analysis are required. All discovered URLs must only be tested on assets within authorized scope.
Related articles
OSINT Investigation Exposes Fraudulent Russian Garlic Investment Scheme Masquerading as Local Production
An in-depth OSINT probe into a Russian agricultural investment project promising 50-70% annual returns from garlic farming has revealed a likely import arbitrage operation sourcing produce from China and Uzbekistan. The project claimed ownership of over 300 hectares of fields, a proprietary seed fund, and guaranteed sales to major retailers including Magnit, Perekrestok, Pyaterochka, and Svetofor, yet public records show minimal profitability and heavy debt. Financial statements from linked cooperatives indicated just 2.2% net margin alongside loans exceeding annual revenue fourfold, pointing to reliance on continuous new investor capital. Registry checks confirmed no financial licenses, no seed-breeding status, and actual cultivated land far below advertised figures. Import declarations and equipment registrations further indicated the operation functions as a repackaging hub for foreign garlic sold under private labels. The parent group has been placed on the Bank of Russia blacklist, with related sites blocked by Roskomnadzor while Telegram channels continue aggressive marketing.
Deploying Self-Hosted Hysteria 2 Proxy on Debian-Based Linux VPS via Terminal
A detailed guide explains how to set up a personal Hysteria 2 proxy server on a KVM VPS running Debian or Ubuntu without any web panels. The process begins with generating ed25519 SSH keys, hardening the sshd_config file, and restricting access with ufw to only TCP port 22 and UDP port 443. Hysteria 2 is downloaded from GitHub, made executable, and configured using a TOML file that enables salamander obfuscation and a self-signed TLS certificate. A custom systemd unit ensures the service restarts on failure. The client configuration includes SHA256 pinning of the server certificate to prevent MITM attacks. The guide emphasizes manual CLI operations that apply equally to other services such as Nginx and stresses checking local laws before deployment.
Rostec Scales PCAT Platform Nationwide as Russia's First Industrial Marketplace
Rostec has expanded its PCAT platform to every organization within the state corporation that manufactures civilian products. Operating since 2025 and upgraded in September 2026, the platform now unites more than 180 enterprises and research organizations. Its catalog contains over 1,250 finished products along with 370 technological and manufacturing competencies. Visitors can locate not only equipment and components but also partners able to design, test, or produce required solutions. The portal receives more than 23,000 weekly visits, 60 percent of them from corporations and large enterprises. Rostec is extending the network into the regions through supply-chain agreements already signed with Krasnodar Krai and the oblasts of Tver, Tula, and Ryazan. In parallel the corporation launched the Robot Management System in November 2025 for centralized control of robots, sensors, and related IT services.
Kate Mobile Loses VK API Access After New Request Limits Exhaust Quota in 1.5 Days
Popular third-party Android client Kate Mobile has been cut off from VK services following the introduction of strict monthly API request caps. VK implemented the new limits on September 7, offering verified partners up to 100 million requests per month while requiring payment for additional access by third-party services. Kate Mobile developers had requested pricing details in advance but received no response from VK. Calculations showed that the app's real user base would consume the entire 100-million-request allowance in roughly 36 hours, with the messages.send method alone generating twice the allowed volume. Caching optimizations cannot mitigate the issue because message sending cannot be cached. Developers view the change as an effort to eliminate alternative clients rather than a genuine monetization strategy. Users expressed disappointment, praising the app's long-term support and criticizing the official VK client for excessive features and advertising.