How I Find Hidden URLs Using waymore

Learn how I use waymore to uncover hidden and historical URLs, configure VirusTotal and URLScan APIs, and improve my bug bounty reconnaissance workflow.

When I first started learning bug bounty hunting, I focused on finding live subdomains and running basic scans. But after some time, I realized I was missing an important part of reconnaissance: historical URLs.

Many interesting endpoints don't appear on the current version of a website. Old admin panels, API endpoints, backup files, and forgotten pages may still exist in archived data even if they are no longer linked from the homepage.

That's when I discovered waymore.

After using it on several bug bounty targets, it became one of the first tools I run during reconnaissance because it helps uncover URLs that are often missed by traditional crawlers.

In this article, I'll explain what waymore is, how I installed it, and how I use it to find hidden URLs more efficiently.

What is waymore?

waymore is an open-source reconnaissance tool that collects URLs from multiple public sources, including historical archives and URL providers.

Instead of relying only on a website's current pages, waymore searches archived data to discover URLs that may have existed months or even years ago.

This can reveal:

Hidden endpoints
Old admin panels
API URLs
JavaScript files
Backup files
Forgotten application paths

These URLs often become valuable starting points during reconnaissance.

Why I Started Using waymore

Before using waymore, my workflow looked like this:

Collect subdomains
Check live hosts
Crawl the website
Search manually for interesting pages

Although this worked, I noticed that many write-ups mentioned endpoints that never appeared during my scans.

The reason was simple.

Those URLs weren't active anymore, but they still existed inside public archives.

That's exactly what waymore helps uncover.

Installing waymore

I installed waymore on my Kali Linux machine using Python.

pip install waymore

pip install waymore

If you're using newer versions of Kali Linux, installing inside a virtual environment avoids the PEP 668 package management error.

After installation, I verified everything was working.

waymore -h

waymore -h

Running My First Scan

My first scan was against a single target.

waymore -i example.com

waymore -i example.com

Within a few minutes, waymore collected URLs from multiple public sources.

I immediately noticed URLs that I had never seen while browsing the website manually.

Some belonged to older versions of the application.

Others pointed to JavaScript files that were no longer linked from the homepage.

Get Better Results with VirusTotal and URLScan API Keys

Before running your first scan, I recommend configuring VirusTotal and URLScan API keys.

By default, waymore works without these API keys, but adding them allows the tool to query additional data sources and often discover more historical URLs during reconnaissance.

First, create a free account on both platforms and generate your API keys.

VirusTotal API: https://www.virustotal.com/gui/my-apikey

URLScan API: https://urlscan.io/user/

Once you have both API keys, open the config.yml file inside the waymore directory and update the following fields:

VIRUSTOTAL_API_KEY: your_virustotal_api_key
URLSCAN_API_KEY: your_urlscan_api_key

VIRUSTOTAL_API_KEY: your_virustotal_api_key
URLSCAN_API_KEY: your_urlscan_api_key

Save the file, and then run your scan:

waymore -i example.com

waymore -i example.com

After configuring these API keys, waymore can gather additional URLs from VirusTotal and URLScan, giving you a more complete view of the target's historical attack surface.

Saving All URLs

One feature I use almost every time is saving the output.

waymore -i example.com -oU urls.txt

waymore -i example.com -oU urls.txt

Instead of copying results from the terminal, every discovered URL is stored in a single text file.

Having everything organized makes the next stage of reconnaissance much easier.

Collecting Archived Responses

waymore can also download archived responses.

waymore -i example.com -mode R

waymore -i example.com -mode R

This is useful when you want to review old content that is no longer available on the live website.

Sometimes archived responses contain information that has since been removed.

My Recon Workflow

This is how I usually use waymore during bug bounty hunting.

Collect subdomains.
Identify live hosts.
Run waymore against the target.
Save all discovered URLs.
Review JavaScript files.
Search for sensitive endpoints.
Continue manual testing.

This process gives me a much larger list of URLs than relying only on a crawler.

Why Historical URLs Matter

One lesson I learned is that applications constantly change.

Developers rename pages.

Old APIs disappear.

Directories are moved.

However, search engines and archives often keep records of those old URLs.

Even if an endpoint no longer exists, it may reveal:

Previous application structure
Interesting naming patterns
Old API versions
Forgotten functionality

This information can help guide further reconnaissance.

Tips

If you're using waymore for the first time, here are a few suggestions.

Save every scan into an output file.
Review JavaScript URLs carefully.
Don't ignore archived endpoints.
Combine waymore with a crawler like Katana.
Organize your findings before starting manual testing.

Good reconnaissance isn't about running dozens of tools.

It's about understanding the information each tool provides.

My Experience

After adding waymore to my workflow, I noticed that I was discovering significantly more URLs than before.
Some of the most interesting endpoints came from archived sources rather than the live website.
While every target is different, waymore consistently gives me additional information that I might have otherwise missed.

That's why it has become one of the first reconnaissance tools I use.

Final Thoughts

waymore doesn't automatically find vulnerabilities.

Instead, it helps uncover valuable reconnaissance data by collecting URLs from historical archives and multiple public sources.

For anyone learning bug bounty or web application security, it's an excellent tool for expanding your attack surface before moving on to manual testing.

If you're only relying on live crawling, you're probably missing information that archived data can reveal.

GitHub Repository

GitHub - xnl-h4ck3r/waymore: Find way more from the Wayback Machine, Common Crawl, Alien Vault OTX… Find way more from the Wayback Machine, Common Crawl, Alien Vault OTX, URLScan, VirusTotal, GhostArchive & Intelligence…