GAU URL CollectorStep-by-step reference: harvest historic URLs with GAU for lab recon. Authorized domains only.FAQ

What is GAU?

GAU is a free, open-source historic URL harvester in Go by Corben Leo. It pulls every archived URL for a domain from Wayback, Common Crawl, OTX, and URLScan — endpoints, params, files, and old subdomains.

Is using GAU legal?

GAU itself queries public archives, which is legitimate OSINT. Testing harvested URLs against systems needs explicit written permission — harvest only owned or signed-scope domains and guard collected URLs as sensitive.

How do I install GAU?

Run go install github.com/lc/gau/v2/cmd/gau@latest. Verify with gau --help. No API keys needed for basic harvesting.

How do I harvest a domain?

Run echo domain | gau against your authorized target. Dedup with sort -u, filter interesting extensions, then validate with HTTPX before scanning.

How do I find parameters for testing?

Grep the harvest for query strings and feed them to DalFox. Historic params expose inputs the live site no longer links to.

Why is most output dead?

Archives remember history, not current state. Dead links are normal — live-filtering with HTTPX is a required pipeline stage, not optional.

How does GAU differ from Katana?

Katana crawls the live app today; GAU recalls what archives saw years ago. Together they cover present plus forgotten attack surface.

What about URLs with tokens?

Treat them as secrets: report, never replay beyond authorized proof, and advise expiry plus rotation for anything still valid.

All tools · Sitemap · Games