OSINT for the Lazy Part 18: Extracting Value from Wayback Machine Archives for Bug Bounty and Security Research
The article examines how OSINT practitioners can leverage web archives for practical security research, particularly in bug bounty programs. Among the many available tools, those that query historical snapshots of websites stand out for their ability to reveal forgotten resources without active scanning.
Common findings from archived copies include old API endpoints, admin and test panels such as /admin, /test, and /debug, configuration and backup files with extensions like .bak, .sql, .old, and .git, as well as JavaScript files containing sensitive parameters or hardcoded keys. Outdated versions of applications may also expose vulnerabilities that have since been patched in the live site.
The primary advantage of this approach is its passive nature: queries are made only against public archives, so the target organization receives no direct requests and detection risk remains minimal.
waybackurls
waybackurls, developed by tomnomnom, is a lightweight Go utility that pulls every indexed URL for a given domain from the Wayback Machine CDX API. It supports subdomains and reveals parameters that can later be tested for issues such as IDOR, open redirect, LFI, and XSS. Installation requires Go and is performed with a single command: go install github.com/tomnomnom/waybackurls@latest.
gau (getallurls)
gau, created by lc, extends coverage by querying four sources simultaneously: Wayback Machine, Common Crawl, AlienVault OTX, and URLScan. It accepts domains via stdin or arguments, supports multiple targets, and offers rich filtering flags including --blacklist, --fc, --mc, --from, --to, and --providers. Installation command: go install github.com/lc/gau/v2/cmd/gau@latest.
waymore
For users preferring Python, waymore by xnl_h4ck3r provides the widest coverage and the ability to download full archived responses. It supports additional sources including VirusTotal, GhostArchive, and Intelligence X. While slower than the Go tools, it excels at retrieving content that can be further analyzed with tools such as xnLinkFinder or trufflehog for secrets and additional links.
Security researchers are encouraged to combine these utilities according to their needs: waybackurls or gau for quick results and waymore when maximum coverage and archived content analysis are required. All discovered URLs must only be tested on assets within authorized scope.
Related articles
Rostelecom Suffers Mass Outage Disrupting Website, Mobile App and Personal Account
Rostelecom experienced a significant service disruption that left its official website, mobile application, and customer personal account either unavailable or functioning with errors. The first reports of problems began arriving around 12:40 Moscow time. Over a 24-hour period, the monitoring service Detector404 recorded approximately 2,500 user complaints. The largest share, 59 percent, originated from the Nizhny Novgorod region, followed by 4 percent from Kursk region and 2 percent each from Ryazan and Ivanovo regions. Rostelecom has not issued any official statement regarding the incident, and the root cause along with the timeline for full restoration remain unknown. The outage occurred in the same week that hosting provider ESTT suffered a similar infrastructure failure.
Russian State Duma Rejects Bill Proposing Fines for Covering Face in Public
On November 11 the State Duma rejected bill No. 1159193-8 that sought to introduce a new article in the Code of Administrative Offenses punishing appearance in public places with a face covered in a way that prevents identification. The draft included exceptions for medical reasons, official duties, weather conditions, and sports or cultural events. Two committees of the Federation Council on defense and security as well as constitutional legislation opposed the measure. The Duma committee on criminal and administrative legislation found the wording too vague and lacking legal certainty. It also noted that new offenses require prior federal-law prohibitions. On the same day lawmakers rejected another bill introducing criminal liability for crimes committed with deepfakes.
Basis Launches Basis AIR Platform to Optimize Shared GPU Resources for AI Projects
Basis, part of the RTK Data Centers group, has introduced Basis AIR, a platform designed to allocate computing resources across multiple AI initiatives within organizations. The solution targets small, medium, and large enterprises that have invested in expensive GPU hardware but face uneven utilization, with some teams waiting for capacity while others leave accelerators idle. According to the company, Basis AIR can increase accelerator utilization from 30% to 80% by enforcing task priorities, departmental quotas, and dynamic resource sharing. The platform supports running multiple workloads on a single accelerator and allows teams to borrow additional capacity when resources are available. It generates detailed consumption reports by project and division, helping executives decide whether new GPU purchases are truly necessary before approving further hardware acquisitions. Basis AIR is deployed on-premises in the customer’s data center, operates without internet connectivity, and integrates with third-party infrastructure platforms without requiring other Basis products.
30 Tools for Six Core Information Security Tasks: From Recon to Forensics
The article provides a practical guide for system administrators managing a single website, database, and server setup. It covers 30 specific tools across six categories: reconnaissance, web application testing, infrastructure scanning, incident response, digital forensics, and secure development practices. Each section recommends five tools with explanations of their use cases, such as discovering forgotten assets like test2 or analyzing network traffic during off-hours incidents. Tools include Subfinder for passive subdomain enumeration, Burp Suite for request inspection, Nmap for port scanning, Zeek for structured logging, Autopsy for disk image analysis, and Gitleaks for secret detection in Git history. The guide emphasizes proper documentation of assets, including ownership confirmation by colleagues like Lena, and highlights limitations such as VPN effects on scan results or TLS termination at load balancers. It concludes by stressing the value of maintaining accurate records to simplify future certificate renewals and incident handling.