getallurls (gau)

repository·master·Indexed 26 days ago

https://github.com/lc/gau

A tool that fetches known URLs for a given domain from multiple sources, including AlienVault's Open Threat Exchange, the Wayback Machine, Common Crawl, and URLScan. It supports input via command-line arguments or stdin, filtering by file extensions, and output in plain text or JSON format.

Tokens
1.7K
Snippets
6
Records
9
Agent score
40%

What's inside gau

  1. Install getallurls (gau)

    master

    You can install gau using several methods:

    From source

    Use go install to install the latest version:

    go install github.com/lc/gau/v2/cmd/gau@latest

    From GitHub

    Clone the repository and build the binary manually:

    git clone https://github.com/lc/gau.git; \
    cd gau/cmd; \
    go build; \
    sudo mv gau /usr/local/bin/;
    gau --version;

    From binary

    Download pre-built binaries from the releases page, extract them, and move the binary to your $PATH:

    tar xvf gau_2.0.6_linux_amd64.tar.gz
    mv gau /usr/bin/gau

    From Docker

    Run the tool directly using the official image:

    docker run --rm sxcurity/gau:latest --help

    Or build your own image:

    docker build -t gau .
    docker run gau example.com

    Note: Piping commands (e.g., echo "example.com" | gau) will not work with the Docker container.

    go install github.com/lc/gau/v2/cmd/gau@latest
  2. Use getallurls (gau) to fetch URLs

    master

    The gau tool fetches known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, Common Crawl, and URLScan for a given domain.

    Basic Usage Examples

    Fetch from stdin:

    printf example.com | gau

    Fetch from a file:

    cat domains.txt | gau --threads 5

    Fetch multiple domains:

    gau example.com google.com

    Save results to a file:

    gau --o example-urls.txt example.com

    Filter by file extensions (blacklist):

    gau --blacklist png,jpg,gif example.com
    gau example.com google.com
  3. Configure getallurls (gau) via configuration file

    master

    By default, gau looks for a configuration file at $HOME/.gau.toml or %USERPROFILE%\.gau.toml.

    • Options specified in the config file are used for every run.
    • Command line flags will override any options set in the configuration file.
    • If no configuration file is found, gau will run with default settings and output a message to stderr.

    You can specify an alternate configuration file using the --config flag.

    gau --config $HOME/.config/gau.toml
  4. Reference: gau CLI flags

    master

    The following flags are available for gau to control output, filtering, and behavior:

    | Flag | Description | Example |
    |------|-------------|---------|
    |`--blacklist`| list of extensions to skip | gau --blacklist ttf,woff,svg,png|
    |`--config` | Use alternate configuration file (default `$HOME/config.toml` or `%USERPROFILE%\/.gau.toml`) | gau --config $HOME/.config/gau.toml|
    |`--fc`| list of status codes to filter | gau --fc 404,302 |
    |`--from`| fetch urls from date (format: YYYYMM) | gau --from 202101 |
    |`--ft`| list of mime-types to filter | gau --ft text/plain|
    |`--fp`| remove different parameters of the same endpoint | gau --fp|
    |`--json`| output as json | gau --json |
    |`--mc`| list of status codes to match | gau --mc 200,500 |
    |`--mt`| list of mime-types to match |gau --mt text/html,application/json|
    |`--o`| filename to write results to | gau --o out.txt |
    |`--providers`| list of providers to use (wayback,commoncrawl,otx,urlscan) | gau --providers wayback|
    |`--proxy`| http proxy to use (socks5:// or http:// | gau --proxy http://proxy.example.com:8080 |
    |`--retries`| retries for HTTP client | gau --retries 10 |
    |`--timeout`| timeout (in seconds) for HTTP client | gau --timeout 60 |
    |`--subs`| include subdomains of target domain | gau example.com --subs |
    |`--threads`| number of workers to spawn | gau example.com --threads |
    |`--to`| fetch urls to date (format: YYYYMM) | example.com --to 202101 |
    |`--verbose`| show verbose output | gau --verbose example.com |
    |`--version`| show gau version | gau --version|
  5. Handle HTTP client errors

    master

    The httpclient package defines specific error variables to identify common failure scenarios during requests:

    var (
    	ErrNilResponse    = errors.New("unexpected nil response")
    	ErrNon200Response = errors.New("API responded with non-200 status code")
    	ErrBadRequest     = errors.New("API responded with 400 status code")
    )
  6. Run gau via CLI

    master

    The gau (getallurls) CLI tool fetches URLs from various providers for a given set of domains. It accepts domains as command-line arguments or via stdin.

    Input Methods:

    1. Command-line arguments: Pass domains directly as arguments.
    2. Standard Input (stdin): Pipe a list of domains into the command.

    Output Modes:

    • Standard Output: By default, results are printed to stdout.
    • File Output: Configure an output file via the configuration settings.
    • JSON Format: Results can be emitted in JSON format instead of plain text.