PAGES
← all tools
◆ Reconnaissance & OSINT

waymore

v8.7 open-source

waymore finds links from the Wayback Machine and other sources, and can also download archived responses to search for additional links.

Summary

waymore is an open-source command-line tool that pulls historical URLs for a target from the Wayback Machine, Common Crawl, AlienVault OTXOTXAlienVault's Open Threat Exchange, a community platform where researchers share indicators of compromise; cyber tools integrate it to pull live threat intelligence feeds without building their own collection infrastructure., URLScan, VirusTotal and GhostArchive, and can also download the archived HTTP responses themselves so you can grep them for further links, developer comments and hidden parameters. It is built for bug bounty hunters and penetration testers doing reconnaissance, and its README positions it directly against waybackurls and gau, arguing that neither downloads archived response bodies or handles source rate limiting gracefully, which is why waymore is slow by design and tuned for coverage over speed. It runs from the terminal, storing config in a local file, and remains active, with 51 commits and 10 releases in the past year across 11 contributors.

waymore finds links from the Wayback Machine and other sources, and can also download archived responses to search for additional links.

How waymore helps

Which URLs has a target ever exposed, even ones long removed from the live site?

queries the Wayback Machine, Common Crawl, AlienVault OTX, URLScan, VirusTotal and GhostArchive together and merges the results into one deduplicated list, going back further than what the live site or a single archive shows

Which forgotten parameters or endpoints can I pull out of a target's old pages?

downloads the archived HTTP response bodies themselves, not just the URLs, so they can be grepped for extra links, developer comments and hidden parameters that never show up in a URL list alone

Am I getting a partial result set because a source throttled me without saying so?

handles the rate limiting each source imposes rather than stopping silently, and reports a per-source count of unique links contributed so a suspiciously low number is visible

Which of these archived files are actually binaries I should skip parsing as text?

inspects the actual content bytes for magic bytes before falling back to the content type header or URL extension, so binary files are saved and labeled correctly instead of being misread as HTML

Did I lose results when a connection dropped mid-crawl?

streams Wayback Machine requests so URLs already collected are saved as they come in rather than being lost if the connection is cut before the run finishes

Can I limit a recon run to what a target exposed in a specific time window?

applies the from and to date bounds across URL collection and response downloads for Wayback, Common Crawl, AlienVault OTX and VirusTotal, so the archive search can be scoped to a period around a known incident or release

all 15 features, with the evidence for each →

Languages

Not documented

Features

15 capabilities · 3 backed by code, an API document or a real run

Built from waymore's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What waymore offers you

  • Command-line interface3
  • Outbound webhooks (the product notifies you)1
All capabilities 15 capabilities
Completion notifications verified Sends a notification via Telegram when the tool finishes a run, configured through a webhook in the config file. 6 releases · 5 other sources · first seen Nov 2024

Also counts toward: Command-line interface, Outbound webhooks (the product notifies you)

release

  • Adds -nt/--notify-telegram flag to send a Telegram webhook notification when a waymore run completes, configured via TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID in config.yml. v7.3 · Dec 2025 · source · release history
  • Adds -nt/--notify-telegram flag to send a Telegram webhook notification when waymore finishes, configured via WEBHOOK_TELEGRAM in config.yml. v7.2 · Dec 2025 · source · release history
  • New INTELX_API_KEY config key in config.yml to authenticate with the Intelligence X API. v5.0 · Mar 2025 · source · release history
  • New -xix flag to exclude Intelligence X from URL collection runs. v5.0 · Mar 2025 · source · release history
  • Adds Intelligence X (intelx.io) as a new URL discovery source via their paid /phonebook/search API. v5.0 · Mar 2025 · source · release history
  • New --providers flag to select URL sources (wayback, commoncrawl, otx, urlscan, virustotal) as a comma-separated list, overriding individual exclude arguments like -xwm, -xcc, etc. v4.6 · Nov 2024 · source · release history

command line

  • --notify-telegram — Whether to send a notification to Telegram when waymore completes. It requires WEBHOOK_TELEGRAM to be provided in the config.yml file. v7.2 · Dec 2025 · command-line history

example

  • Get a Telegram alert when a long waymore crawl finishes, so you don't have to watch the terminal. waymore -i example.com -nt v7.3 · Dec 2025 · source
  • Get a Telegram ping when a long waymore crawl finishes, so you don't have to babysit the terminal. waymore -i example.com -nt v7.2 · Dec 2025 · source
  • Skip the Intelligence X source (e.g., no paid key available) while still querying all other sources. waymore -i example.com -xix v5.0 · Mar 2025 · source
  • Limit sources to Wayback Machine and URLScan only — useful when you want to skip slow or unreliable providers like Common Crawl. waymore -i example.com --providers wayback,urlscan v4.6 · Nov 2024 · source
Source IP binding verified Binds outbound HTTP/HTTPS requests to a specified source IP address, useful on multi-homed hosts. 5 releases · 2 other sources · first seen Dec 2025

Also counts toward: Command-line interface

release

  • Adds --source-ip / --bind-ip CLI argument and SOURCE_IP config option to bind all outbound HTTP/HTTPS requests to a specific local IP address. v7.6 · Jan 2026 · source · release history
  • Adds async concurrent fetching across all six URL sources (Wayback Machine, Common Crawl, AlienVault OTX, URLScan, VirusTotal, Intelligence X) for 2-4x faster multi-source runs. v7.0 · Dec 2025 · source · release history
  • One source failure no longer halts others — concurrent error handling keeps remaining sources running. v7.0 · Dec 2025 · source · release history
  • Wayback Machine requests now use streaming (stream=True) so URLs collected before a dropped connection are saved rather than lost. v7.0 · Dec 2025 · source · release history
  • Reduces memory usage by storing links in source-specific sets during processing and merging only at the end, clearing source sets immediately after. v7.0 · Dec 2025 · source · release history

command line

  • --source-ip — Bind outbound HTTP/HTTPS requests to this source IP (useful on multi-homed hosts). v7.6 · Jan 2026 · command-line history

example

  • Force waymore to egress through a specific whitelisted IP on a multi-homed host, e.g. when a target only allows requests from a known scanner IP. waymore -i example.com --source-ip 203.0.113.42 v7.6 · Jan 2026 · source
Date-range filtering for URL collection and responses shipped suggested Applies date bounds to URL discovery across multiple sources (Wayback, Common Crawl, AlienVault, VirusTotal) and supports filtering archived responses independently of collection. 4 releases · 3 other sources · first seen Nov 2025

Suggested capability: Attack surface inventory. This is our guess, not confirmed.

Also counts toward: Command-line interface

release

  • Extends date-range filtering to Common Crawl, AlienVault OTX, and VirusTotal URL sources — Common Crawl index selection now driven by these flags instead of the removed -lcy argument. v6.6 · Nov 2025 · source · release history
  • Applies -from/--from-date and -to/--to-date date bounds to Wayback Archive URL collection (mode U), not just response downloads (mode R). v6.6 · Nov 2025 · source · release history
  • Date filters are skipped for URL collection when -f/--filter-responses-only is passed, preserving existing filter-only workflows. v6.6 · Nov 2025 · source · release history
  • The -lcy argument is removed; use -from/--from-date and -to/--to-date to control which Common Crawl indexes are queried. v6.6 · Nov 2025 · source · release history

docs

  • Finds URLs and downloads archived responses from Wayback Machine, Common Crawl, AlienVault, URLScan, VirusTotal, and other sources for a target domain.

example

  • Collect URLs from all sources (Wayback, Common Crawl, AlienVault, VirusTotal) scoped to a specific year — useful for narrowing recon to a known vulnerable window. waymore -i example.com -mode U -from 20230101 -to 20231231 v6.6 · Nov 2025 · source
  • Download archived responses for a target within a date range without also applying the date filter to URL collection (filter-responses-only mode). waymore -i example.com -mode R -from 20230101 -to 20231231 -f v6.6 · Nov 2025 · source
MIME type filtering and matching shipped suggested Allows users to filter out or match specific MIME types (such as images, fonts, JS, or JSON) during content discovery to reduce noise or focus on specific file formats. 3 releases · 2 other sources · first seen Nov 2024

Suggested capability: Attack surface inventory. This is our guess, not confirmed.

release

  • Updates MIME type validation regex for -ft / --filter-mime-types and -mt / --match-mime-types to accept all RFC-valid token characters (e.g., ., _, !). v8.6 · Mar 2026 · source · release history
  • New -ft flag to specify MIME types to filter, overriding the FILTER_MIME list in config.yml. v4.6 · Nov 2024 · source · release history
  • New -mt flag to specify MIME types to match, replacing the default FILTER_MIME filtering or -ft filtering. v4.6 · Nov 2024 · source · release history

example

  • Collect only JavaScript and JSON responses by matching on MIME type — cuts noise when recon-ing for JS endpoints. waymore -i example.com -mt application/javascript,application/json v4.6 · Nov 2024 · source
  • Exclude image and font MIME types from results to focus on document and script URLs. waymore -i example.com -ft image/png,image/jpeg,font/woff2 v4.6 · Nov 2024 · source
GhostArchive integration shipped suggested Adds GhostArchive as a source for URL discovery and archived HTTP response downloads, with options to exclude it from link checks. 3 releases · 2 other sources · first seen Jan 2026

Suggested capability: Attack surface inventory. This is our guess, not confirmed.

release

  • Extends --providers to accept ghostarchive as a valid provider value. v8.0 · Jan 2026 · source · release history
  • New -xga flag to exclude GhostArchive from URL link checks. v8.0 · Jan 2026 · source · release history
  • Adds GhostArchive (ghostarchive.org) as a new URL source for -mode U and -mode R, crawling paginated HTML pages to extract archived URLs and downloading WARC files for HTTP responses. v8.0 · Jan 2026 · source · release history

example

  • Download archived HTTP responses from GhostArchive WARC files while skipping GhostArchive link extraction to avoid noise. waymore -i example.com -mode R -xga v8.0 · Jan 2026 · source
  • Pull all archived URLs for a target including GhostArchive results, which were unavailable before v8.0. waymore -i example.com -mode U --providers ghostarchive v8.0 · Jan 2026 · source
URL and MIME filtering updates shipped Updates default filters for URL extensions and MIME types, including adding new exclusions (AVIF, audio/video) and removing existing ones (PDF). 5 releases · first seen Jan 2026

release

  • application/pdf removed from FILTER_MIME defaults so PDF files are no longer filtered out — surfaces potentially valuable archived documents. v8.0 · Jan 2026 · source · release history
  • application/pdf is removed from FILTER_MIME in config.yml and DEFAULT_FILTER_MIME, meaning PDFs that were previously filtered out will now appear in results on upgrade. v8.0 · Jan 2026 · source · release history
  • Adds .avif to FILTER_URL and image/avif to FILTER_MIME defaults so AVIF images are filtered from results. v8.0 · Jan 2026 · source · release history
  • Adds more audio and video extensions to FILTER_URL defaults and config.yml to broaden automatic URL filtering. v7.7 · Jan 2026 · source · release history
  • Adds more audio and video MIME types to FILTER_MIME defaults and config.yml. v7.7 · Jan 2026 · source · release history
Binary file handling shipped Provides mechanisms for detecting, naming, and retrieving binary files from archives, including magic byte inspection and raw content retrieval. 5 releases · first seen Jan 2026

release

  • Binary files with no determinable extension now saved as .bin instead of .unknown. v7.7 · Jan 2026 · source · release history
  • Introduces BINARY_MIME_TYPES constant covering 40+ binary MIME types for accurate binary detection during downloads. v7.7 · Jan 2026 · source · release history
  • Introduces BINARY_EXTENSIONS constant covering 50+ binary file extensions for accurate binary detection during downloads. v7.7 · Jan 2026 · source · release history
  • Binary files downloaded with -mode R now use the Wayback Machine id_ modifier (e.g., /web/20090315210455id_/http://...) to retrieve raw originals without Wayback Machine modifications. v7.7 · Jan 2026 · source · release history
  • New isBinaryContent() function inspects actual content bytes (magic bytes) before falling back to Content-Type header or URL extension, ensuring HTML error pages aren't misidentified as binary. v7.7 · Jan 2026 · source · release history
Real-time URL streaming shipped suggested Outputs discovered URLs to STDOUT in real time as they are found, allowing for intermediate filtering or processing without waiting for the run to complete. 1 release · 2 other sources · first seen Oct 2025

Suggested capability: Attack surface inventory. This is our guess, not confirmed.

release

  • Adds --stream argument to output URLs to STDOUT in real time as they are found (works with -mode U only; use -oU to also save deduplicated results to file). v6.2 · Oct 2025 · source · release history

example

  • Pipe live URL discoveries into a grep filter during a recon session without waiting for waymore to finish. waymore -i example.com -mode U --stream | grep '\.js' v6.2 · Oct 2025 · source
  • Stream URLs to STDOUT in real time while also saving a deduplicated copy to a file for later analysis. waymore -i example.com -mode U --stream -oU results.txt v6.2 · Oct 2025 · source
Configuration auto-creation shipped Automatically generates a default config.yml file if one is not present in the expected location at startup. 2 releases · first seen Jan 2026

release

  • Automatically creates config.yml with default values in the expected config directory (~/.config/waymore/ on Linux, %APPDATA%/waymore/ on Windows) when the file is not found. v8.7 · Mar 2026 · source · release history
  • Auto-creates config.yml with default values if not found in the default location at startup. v8.1 · Jan 2026 · source · release history
Regex and keyword filtering shipped Filters discovered URLs using regex or keyword patterns, with argument validation and automatic anchoring for archive API compatibility. 2 releases · first seen Mar 2026

release

  • Adds immediate regex validation for -ko and -ra arguments with a clear error message and hint to use single quotes. v8.6 · Mar 2026 · source · release history
  • Wraps -ko / --regex-after patterns with cdxKeywordsFilter() to auto-apply .* prefix/suffix for Wayback CDX and Common Crawl APIs, enabling flexible substring anchoring. v8.6 · Mar 2026 · source · release history
Verbose output enhancements shipped Adds visibility for specific configuration options in verbose mode and includes debug output for the file currently being processed. 2 releases · first seen Jan 2026

release

  • The --source-ip option is now shown in output only when explicitly configured (visible in verbose -v mode). v7.7 · Jan 2026 · source · release history
  • Adds extra debug output showing the file currently being processed to assist in diagnosing hangs. v7.7 · Jan 2026 · source · release history
Archive source filtering verified Allows selectively excluding specific archive sources, such as ghostarchive.org, from link discovery checks. 1 other source · first seen Jan 2026

command line

Concurrency support for IntelX shipped Enables concurrent operations against IntelX services by using thread-local storage for configuration. 1 release · first seen Jan 2026

release

  • Adds thread-local storage for IntelX URL configuration to support concurrent IntelX operations. v7.5 · Jan 2026 · source · release history
IntelX endpoint auto-fallback shipped Automatically switches between paid and free Intelligence X API endpoints based on HTTP error codes. 1 release · first seen Jan 2026

release

  • Adds automatic fallback between paid (2.intelx.io) and free (free.intelx.io) Intelligence X endpoints, switching on 401/402/403 errors so users with either API key type get results without manual reconfiguration. v7.5 · Jan 2026 · source · release history
Source-specific link statistics shipped Displays the count of distinct URLs contributed by each individual source in the output. 1 release · first seen Dec 2025

release

  • Adds per-source unique link counts in output, showing how many distinct URLs each source contributed. v7.0 · Dec 2025 · source · release history

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for waymore, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail waymore puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

16 entries

  1. March 20262
  2. January 20265
  3. December 20254
  4. November 20251
  5. October 20251
  6. March 20252
  7. November 20241
    Show

    16 entries

    Project health

    Issue, contributor and maintainer activity in xnl-h4ck3r/waymore, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 4 +1 vs prior 12 months
    2. Maintainers 2 +1 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close 17 days first maintainer reply 8.6 hours
    6. Open backlog 2 of 64 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 2
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 2,753
    Issue themes, last 12 months
    • questions 14%
    • other 86%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →