OSINT for the Lazy Part 18: Extracting Value from Wayback Machine Archives for Bug Bounty and Security Research
The article examines how OSINT practitioners can leverage web archives for practical security research, particularly in bug bounty programs. Among the many available tools, those that query historical snapshots of websites stand out for their ability to reveal forgotten resources without active scanning.
Common findings from archived copies include old API endpoints, admin and test panels such as /admin, /test, and /debug, configuration and backup files with extensions like .bak, .sql, .old, and .git, as well as JavaScript files containing sensitive parameters or hardcoded keys. Outdated versions of applications may also expose vulnerabilities that have since been patched in the live site.
The primary advantage of this approach is its passive nature: queries are made only against public archives, so the target organization receives no direct requests and detection risk remains minimal.
waybackurls
waybackurls, developed by tomnomnom, is a lightweight Go utility that pulls every indexed URL for a given domain from the Wayback Machine CDX API. It supports subdomains and reveals parameters that can later be tested for issues such as IDOR, open redirect, LFI, and XSS. Installation requires Go and is performed with a single command: go install github.com/tomnomnom/waybackurls@latest.
gau (getallurls)
gau, created by lc, extends coverage by querying four sources simultaneously: Wayback Machine, Common Crawl, AlienVault OTX, and URLScan. It accepts domains via stdin or arguments, supports multiple targets, and offers rich filtering flags including --blacklist, --fc, --mc, --from, --to, and --providers. Installation command: go install github.com/lc/gau/v2/cmd/gau@latest.
waymore
For users preferring Python, waymore by xnl_h4ck3r provides the widest coverage and the ability to download full archived responses. It supports additional sources including VirusTotal, GhostArchive, and Intelligence X. While slower than the Go tools, it excels at retrieving content that can be further analyzed with tools such as xnLinkFinder or trufflehog for secrets and additional links.
Security researchers are encouraged to combine these utilities according to their needs: waybackurls or gau for quick results and waymore when maximum coverage and archived content analysis are required. All discovered URLs must only be tested on assets within authorized scope.
Related articles
Teenage Smartphone Addiction: Causes, Consequences, and Treatment Approaches
Smartphone use has become an integral part of adolescent life, but problematic usage patterns rather than device ownership itself are the focus of concern. Medical experts avoid the term smartphone addiction and instead address issues like disrupted self-control, social media overuse, and gaming disorder that interfere with sleep, studies, relationships, and mental health. Data from Pew Research indicates nearly 50% of U.S. teens aged 13-17 are online almost constantly, while CDC findings link four or more hours of daily screen time to elevated anxiety and depression symptoms. Family digital habits strongly influence teen behavior, and rigid bans often fail without addressing underlying issues such as boredom, anxiety, or social isolation. Parents are advised to track specific disruptions over a week and consider professional help when signs of depression, bullying, or self-harm appear alongside device overuse.
VK WorkSpace Federation Enables Secure Multi-Organization On-Premise Messaging Without Infrastructure Merge
VK Tech has released federation capabilities for its VK WorkSpace corporate messenger that connect independent On-Premise installations while preserving each organization's full control over data, administration, and security policies. The feature, first piloted in November 2025 and expanded in the July 2026 26.2 release, supports multi-party chats across more than two separate environments. Federation relies on mutual trust establishment and per-user access grants rather than full directory replication or proxy access to a single host instance. Each participating organization maintains local copies of messages, files, and chat metadata, allowing continued access even if a partner installation becomes unavailable. The architecture deliberately avoids both centralized hosting and open protocols such as Matrix to keep changes to the existing messenger core minimal. Administrators retain independent levers to create or revoke trusts and to limit which employees may communicate externally.
Sergey Volkov of Cloud.ru Named Top CISO in Russian IT Sector Ranking
Sergey Volkov, Director of the Cyber Protection Center at Cloud.ru, has secured first place in the information security category of the annual Top-1000 Russian Managers ranking. The ranking, published by the Association of Managers in the Kommersant newspaper since 2001, is compiled through peer evaluations by top executives followed by review from expert commissions. Volkov oversees information security strategy and operations for Cloud.ru, and his top position reflects professional recognition of his leadership results. The Association also analyzed broader achievements among laureates and identified key trends in Russian management. Artificial intelligence adoption for business process optimization appeared in 80 percent of reviewed accomplishments. Client orientation through user experience analysis and personalized solutions ranked second, while operational efficiency via cost reduction, automation, and digitalization took third place.
Russia Hands Down First Conviction Under New Criminal Article for Online Drug Propaganda
A resident of Orenburg became the first person in Russia to receive a criminal sentence under Article 230.3 of the Criminal Code, which criminalizes online drug propaganda following repeated administrative violations. The man was fined 100,000 rubles and had his mobile phone confiscated after he printed and posted leaflets containing a QR code that directed users to job advertisements linked to drug distribution. The scheme began when he was recruited via messenger to place the leaflets for 10 rubles each, without realizing the content involved narcotics-related vacancies. Prior to this case, the individual had already been sanctioned twice within the same year for illegal drug advertising, allowing prosecutors to escalate the matter to the new criminal provision that took effect on 1 March. The court considered his prior record as a recidivism aggravating factor yet imposed the minimum fine after he admitted guilt, expressed remorse, and cooperated with investigators. The ruling has already entered into force, marking the initial application of the statute that permits penalties up to two years of imprisonment or fines between 100,000 and 300,000 rubles.