https://cybertoolchain.io/tools/xnlinkfinder New releases and features in xnLinkFinder, tracked by The Cyber Toolchain. en Thu, 08 Jan 2026 17:20:55 GMT https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.18 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.18 Thu, 08 Jan 2026 17:20:55 GMT xnLinkFinder v7.18 adds configurable max response size and streaming HTTP to skip large/binary files automatically. • New `-mrs` / `--max-response-size` argument sets the maximum response size in MB (default: 100 MB); responses exceeding this limit are skipped. • HTTP requests now use streaming to inspect Content-Length and Content-Type headers before downloading, automatically skipping large or binary-content responses (e.g., `.pth`, `.bin`, `.exe`, archives). • Faster startup via lazy-loading of heavy imports (`playwright`, `tldextract`, `inflect`) and deferred PDF-related checks — each loaded only when the relevant feature is actually used. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.16 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.16 Wed, 07 Jan 2026 17:02:49 GMT xnLinkFinder v7.16 adds BeautifulSoup-powered readable HTML parsing and a new `-ro` flag to extract only human-visible links. • Adds BeautifulSoup-based readable HTML extraction that strips `<script>`, `<style>`, `<noscript>`, and `<template>` tags before searching for links, surfacing encoded URLs that raw parsing misses. • New `-ro`/`--readable-only` flag restricts link extraction to human-visible page content, filtering out JS/CSS links — useful when hunting domain-specific links in blogs or CMS-heavy sites. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.15 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.15 Wed, 07 Jan 2026 00:44:35 GMT xnLinkFinder v7.15 adds OCR fallback for scanned PDFs and smarter PDF detection via magic bytes. • Adds OCR fallback using `ocrmypdf` to extract links from scanned or image-only PDFs when `pdftotext` and `pypdf` yield no text. • Supports PDF link extraction when a directory or a single `.pdf` file is passed directly as input. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.14 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.14 Tue, 06 Jan 2026 19:03:32 GMT xnLinkFinder v7.14 adds PDF link extraction via pdftotext or pypdf fallback. • Extracts links and parameters from PDF files by converting `.pdf` URL responses to text using `pdftotext` (if installed) or the `pypdf` Python library as a fallback. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.13 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.13 Tue, 06 Jan 2026 17:04:26 GMT xnLinkFinder v7.13 adds HTTP Keep-Alive via persistent sessions and per-worker session init for faster multi-URL crawling. • Implements HTTP Keep-Alive by reusing `requests.Session` objects across requests, reducing TCP/TLS handshake overhead when crawling multiple URLs on the same host. • Adds `init_worker` function to initialize a persistent `requests.Session` in each worker process under multiprocessing, improving throughput in parallel crawls. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.12 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.12 Sat, 03 Jan 2026 00:25:42 GMT xnLinkFinder v7.12 adds --heap to capture browser heap snapshots via Playwright and extract dynamically generated links from memory. • Adds `--heap` argument to capture browser heap snapshots using Playwright and extract links from in-memory strings, surfacing dynamically generated URLs that static analysis misses. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.9 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.9 Wed, 17 Dec 2025 21:22:13 GMT xnLinkFinder v7.9 improves wordlist generation with the `inflect` library for accurate singular/plural variations. • Replaces rule-based plural handling with the `inflect` library, correctly generating irregular plurals (child→children, person→people), -f/-fe words (knife→knives, leaf→leaves), and Latin/Greek plurals (analysis→analyses, criterion→criteria) in wordlist output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.8 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.8 Mon, 15 Dec 2025 21:45:51 GMT xnLinkFinder v7.8 adds HAR file support, enabling link and parameter extraction from recorded browser sessions. • Supports HAR (HTTP Archive) files as input via `-i`, extracting links and parameters from both requests and responses. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.7 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.7 Mon, 15 Dec 2025 00:58:07 GMT xnLinkFinder v7.7 now searches proxy Request data (not just Responses) for links and parameters. • Adds link and parameter extraction from proxy Request data in addition to Responses when a proxy file is passed as input. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.5 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.5 Thu, 11 Dec 2025 00:32:23 GMT xnLinkFinder v7.5 adds unicode/percent-encoded domain detection and intelligent chunking for large responses. • Supports unicode and percent-encoded characters in domain matching, catching domains like `thisätest.com` and `this%C3%A4test.com`. • Adds automatic content chunking for responses over 50KB, splitting into overlapping 40KB chunks with 5KB overlap to ensure complete link discovery without regex timeouts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.3 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.3 Fri, 17 Oct 2025 14:25:37 GMT xnLinkFinder v7.3 adds domain-format detection so domain-only input files are correctly processed as URL inputs. • Adds is_domain_format() function to detect domain/subdomain-formatted lines (e.g., `example.com`, `sub.example.com`, `example.co.uk`), enabling input files and STDIN starting with bare domains to be correctly identified and processed as URL files rather than content files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.1 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.1 Wed, 08 Oct 2025 20:52:12 GMT xnLinkFinder v7.1 adds configurable request retries with automatic back-off on 429/5xx errors. • New `-r`/`--retries` argument lets you specify up to 5 automatic retries on timeout, connection error, or HTTP 429/500/502/503/504 responses. • New HTTPAdapter automatically retries failed requests the specified number of times without extra scripting. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.0 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v7.0 Tue, 30 Sep 2025 14:03:11 GMT xnLinkFinder v7.0 adds rate limiting and broader HTML form field parameter extraction. • New `-rl`/`--rate-limit` flag sets a maximum requests-per-second cap to respect bug bounty scope rate limits. • When `respParamInputField` is enabled in `config.yml`, parameter names are now extracted from `<select>` and `<button>` HTML fields in addition to `<input>` and `<textarea>`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.17 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.17 Mon, 29 Sep 2025 21:53:13 GMT xnLinkFinder v6.17 adds SPA hash-route link extraction and filters out ellipsis-prefixed false positives. • Extracts links starting with `#/` to surface hash-based routing endpoints in single-page applications (e.g., AngularJS). • Automatically excludes links starting with `...` to reduce noise from false-positive matches. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.15 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.15 Mon, 21 Apr 2025 17:24:59 GMT xnLinkFinder v6.15 extracts potential links from S3 bucket file listings via <Key> XML tags. • Extracts potential links from S3 bucket file listings where file names appear in `<Key></Key>` XML tags. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.14 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.14 Sun, 13 Apr 2025 20:37:23 GMT xnLinkFinder now extracts parameter names from `textarea` fields and searches JS responses when `respParamInputField` is enabled. • Expands `respParamInputField` extraction to include HTML `textarea` fields in addition to `input` fields. • Extends `respParamInputField` response scanning to JavaScript content types, catching parameters built dynamically in JS code. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.13 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.13 Wed, 19 Mar 2025 22:49:19 GMT xnLinkFinder v6.13 improves Waymore mode: supports new waymore_index.txt format and enables depth-0 link extraction from index files. • Supports both `waymore_index.txt` (waymore v6.0+) and legacy `index.txt` (pre-v6.0) index file formats in Waymore mode. • Extracts links from the waymore index file even when `-d`/`--depth` is set to 0 in Waymore mode. • Displays the `-d`/`--depth` parameter value in `-vv` verbose output when a directory is passed as input. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.9 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.9 Tue, 04 Mar 2025 23:29:10 GMT xnLinkFinder v6.9 auto-detects URL lists vs. raw file content when using -i/--input. • Adds auto-detection for `-i`/`--input` files: if the first line starts with `//` or `http`, the file is processed as a URL list; otherwise its content is searched for links (Burp/Zap/Caido files remain handled as before). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.8 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.8 Fri, 28 Feb 2025 00:02:51 GMT xnLinkFinder v6.8 adds Content-Length display during crawling to quickly spot heavy or anomalous responses. • Adds `-cl`/`--content-length` flag to display the Content-Length of each crawled response alongside the status code and URL. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.7 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.7 Wed, 26 Feb 2025 21:08:11 GMT xnLinkFinder v6.7 adds TLD-aware filtering and a new --all-tlds flag to control domain false-positive rates. • New `commonTLDs` config key in `config.yml` (top 50 TLDs) lets users define which TLD set is used to filter discovered domain links. • New `-all`/`--all-tlds` flag returns links with any TLD, trading precision for recall when broader coverage is needed. • Extra-regex domain extraction now filters out invalid TLDs, too-short labels, and a hardcoded blocklist of common variable/JS names to cut false positives. • Excludes any discovered links that begin with a `-` character. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.5 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.5 Tue, 25 Feb 2025 21:24:21 GMT xnLinkFinder v6.5 adds TLD-validated regex expansion and quote-encoding normalization to surface more links with fewer false positives. • Adds a secondary regex pass that catches previously missed links by validating discovered URLs against a TLD check before including them. • Normalizes multiple encodings of double quotes to `"` before link extraction to maximize links found in encoded content. • Filters outbound requests to only follow links whose TLD is valid, reducing noise during active crawling. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.2 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.2 Mon, 27 May 2024 19:17:03 GMT Adds support for extracting parameter names from nested objects and extends content type exclusions • Add same functionality as GAP Burp extension to extract parameter names from nested objects too. • Added `video/x-ms-wmv,image/x-png,video/quicktime,image/x-ms-bmp,font/opentype,application/x-font-opentype,application/x-woff,audio/aiff` to `DEFAULT_CONTENTTYPE_EXCLUSIONS` constant and also to `CONTENTTYPE_EXCLUSIONS` in `config.yml`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.1 https://github.com/xnl-h4ck3r/xnLinkFinder/releases/tag/v6.1 Tue, 14 May 2024 12:13:46 GMT xnLinkFinder v6.1 adds -uc/--user-agent-custom for overriding User-Agent headers • Adds `-uc`/`--user-agent-custom` CLI argument to specify a single custom User Agent string that overrides the default `-u`/`--user-agent` argument Full history on Cyber Toolchain: https://cybertoolchain.io/tools/xnlinkfinder