EndpointHunter is a powerful bug bounty tool designed to hunt and extract API endpoints, LFI paths, secrets, and cloud storage URLs from JS, CSS, and HTML files. It's built for efficiency, supporting multi-threaded scanning and seamless integration with other popular recon tools.
- 🔍 Extracts: API Endpoints (v1, graphql, rest, etc.), Query Parameters, LFI/Path Traversal vectors, Secrets (Tokens, Keys, JWT), S3 Buckets, and Internal IPs.
- ⚡ Multi-threaded: Fast processing of multiple targets.
- 🔗 Smart Recon: Automatically finds and scans linked JS/CSS files from a target HTML page.
- 🛠️ Pipeline Friendly: Works perfectly with
cat,grep,katana,gau,waybackurls, etc. - 🧹 Noise Reduction: Automatically filters out common static assets like images, fonts, and icons.
-
Clone the repository:
git clone https://github.com/MrDestroyer/endpointhunter.git cd endpointhunter -
Install dependencies:
pip install requests
Scan a single target for hidden endpoints and queries:
python3 endpointhunter.py -u https://example.comScan a list of URLs from a file:
cat urls.txt | python3 endpointhunter.py --threads 10Save the extracted findings to a text file:
python3 endpointhunter.py -u https://example.com -o results.txtEndpointHunter is designed to sit in the middle of your recon pipeline.
Crawl a site and hunt for endpoints in all discovered JS files:
katana -u https://target.com -d 3 | grep ".js" | python3 endpointhunter.pyFetch historical URLs and pipe them to hunt for secrets:
gau target.com | grep -E "\.js|\.html" | python3 endpointhunter.pywaybackurls target.com | grep ".js" | python3 endpointhunter.pyDeveloped with ❤️ by MrDestroyer.
- YouTube: @Study_Hard69
- TryHackMe: MohammadZim
- Facebook: zimthegoat
- Instagram: @zimthegoat
If this tool helped you in your bug hunting journey, please star this repository! It helps more people discover the tool and keeps me motivated to add more features.
Happy Hunting!