lc/gau
Gau
Gau is a command-line tool and passive URL enumerator designed to discover and aggregate known and historical web addresses for specific target domains. It functions as a collection framework that retrieves domain-specific data from public web archives and threat intelligence providers.
The tool focuses on passive reconnaissance and open-source intelligence research to map attack surfaces without sending requests directly to target infrastructure. It aggregates data from multiple external sources to identify accessible web endpoints and forgotten pages.
The system includes capabilities for refining discovered URL lists through inclusion and exclusion rules based on status codes, file extensions, and date ranges. Collected data can be exported to external files or standard output in structured formats for further analysis.
Persistent global settings and default behaviors can be managed via a local configuration file.
Features
- Domain Reconnaissance - Finds all known and historical URLs for a target domain by querying public web archives and threat intelligence providers.
- Passive URL Enumerations - A feature for retrieving archived web addresses for a specific domain by querying public web archives and threat intelligence providers.
- Multi-Source Data Aggregation - Aggregates historical URL data from multiple third-party web archives and threat intelligence providers.
- URL Filtering Strategies - Refines discovered web addresses by applying inclusion or exclusion rules based on status codes and extensions.
- URL Result Filtering - Processes raw URL lists through exclusion and inclusion rules based on status codes and file extensions.
- URL Collection Frameworks - Functions as a collection framework for fetching, filtering, and exporting web address lists.
- Passive URL Enumeration - Discovers historical and current URLs without sending requests directly to the target infrastructure.
- Attack Surface Mapping - Identifies the full range of accessible web endpoints to discover forgotten pages or exposed assets.
- Target Domain Isolation - Implements logic to isolate and extract all historical web addresses for specific target root domains.
- URL Discovery Tools - Provides a command-line interface to retrieve known web addresses for a target domain via public archives.
- Reconnaissance Tools - Aggregates domain-specific URL data from external archives to map an application's attack surface.
- Security and OSINT - Collects archived links and historical web data from multiple public sources for OSINT research.
- Security Assessment Preparations - Gathers and filters comprehensive URL lists to prepare for vulnerability scanning and security audits.
- Asset Discovery Tools - Extracts target-related information from multiple web sources.
- Endpoint Discovery - Fetches URLs from various threat intelligence sources.
- General API Utilities - Fetches known URLs from various threat intelligence and web archives.
- Reconnaissance and Discovery - Fetch known URLs from AlienVault, Wayback Machine, and Common Crawl.
- Reconnaissance Tools - Fetches known URLs from threat intelligence and archive sources.
- URL Discovery and Management - Fetch known URLs from various open-source intelligence services.
- Web Archive Tools - Fetches known website URLs from multiple threat intelligence and archive sources.
- Web Asset Discovery - Retrieves known URLs from multiple threat intelligence sources.
- Web Reconnaissance - Fetches URLs from various threat intelligence sources.
