Get All URLs with gau: A Bug Hunter's Shortcut to the Past

Every bug bounty hunter knows the feeling: you've mapped the live site, poked every parameter, and found nothing. The bug is probably hiding in a forgotten endpoint from past. That's where gau comes in.

Gau (Get All URLs) is a passive reconnaissance tool that pulls known URLs for a target domain from public archives the Wayback Machine, Common Crawl, AlienVault OTX, and URLScan. It never touches the target directly, making it fast, quiet, and safe for early-stage recon.

Installation (Pick Your Poison)

MacOS (Homebrew):

brew install gau

brew install gau

Go (any platform):

go install github.com/lc/gau/v2/cmd/gau@latest

go install github.com/lc/gau/v2/cmd/gau@latest

The .gau.toml Setup:

The fastest way to get started is to pull the official example config straight from the repo:

curl https://raw.githubusercontent.com/lc/gau/refs/heads/master/.gau.toml > ~/.gau.toml

curl https://raw.githubusercontent.com/lc/gau/refs/heads/master/.gau.toml > ~/.gau.toml

This is how it looks:

• urlscan works without a key but is heavily rate-limited, get a free API key and paste it in.
• threads = 2 is conservative bump to 5 or 10 on a stable connection.

Basic Usage:

# Basic
gau target.com

# Include subdomains
gau --subs target.com

# Only recent URLs (from Jan 2025)
gau --from 202401 target.com

# Collapse parameter variations (?id=1 and ?id=2 → one URL)
gau --fp target.com

# Power move: pipe into httpx for live endpoints
gau --subs target.com | httpx -silent -mc 200

# Basic
gau target.com

# Include subdomains
gau --subs target.com

# Only recent URLs (from Jan 2025)
gau --from 202401 target.com

# Collapse parameter variations (?id=1 and ?id=2 → one URL)
gau --fp target.com

# Power move: pipe into httpx for live endpoints
gau --subs target.com | httpx -silent -mc 200

Notes

• .gau.toml already filters junk extensions (images, fonts) no need to repeat - -blacklist on the command line.
• Command-line flags override config values (they don't merge) use flags only for one-off overrides or shareable copy-paste commands.
• Next steps after gau: grep for parameters (grep "?"), hunt juicy extensions (.bak, .env, .sql), feed into nuclei or ffuf.

Bottom line

gau won't find bugs for you, it hands you a map of where bugs used to live (and often still do). Configure once, run first on every new target.