paramatrix - Mining URLs from the hidden corners of Wayback Archives for bug hunting, fuzzing, and security probing.
paramatrix allows you to fetch URLs related to any domain or a list of domains from Wayback achives. It filters out "boring" URLs, allowing you to focus on the ones that matter the most.
Paramatrix is a powerful tool designed for bug bounty hunters, penetration testers, and developers interested in web security. It fetches URLs associated with a specific domain (or list of domains) directly from the Wayback Machine. By filtering out "boring" URLs, it allows you to focus on those with parameters—ideal for fuzzing, security probing, and collecting insights.
- Wayback Archive Mining: Fetch URLs directly from the Internet Archive’s Wayback Machine.
- URL Filtering: Ignores common static files, such as
.jpg,.css, etc., providing you with URLs that are more likely to be interesting for testing. - Customizable Placeholder: Replace parameter values with a custom placeholder, making URLs fuzz-ready.
- Retry Mechanism: Automatically retries when connectivity issues occur.
- User-Agent Rotation: Rotates user-agents to minimize detection by anti-bot mechanisms.
- Proxy Support: Allows requests to be routed through a proxy if specified.
go install github.com/Karthik-HR0/paramatrix@latestGet started with some practical scenarios for using Paramatrix:
Fetch URLs for a Single Domain:
paramatrix -d example.comFetch URLs for Multiple Domains from a File:
paramatrix -l domains.txtStream URLs in Real-Time to the Terminal:
paramatrix -d example.com -sUse a Proxy for Web Requests:
paramatrix -d example.com --proxy '127.0.0.1:8080'Customize Placeholder for Parameter Values:
paramatrix -d example.com -p "<injection>"| Argument | Description | Default |
|---|---|---|
-d DOMAIN |
Specify a single domain to fetch URLs for | None |
-l LIST |
Provide a file with a list of domains (one per line) | None |
-s |
Stream URLs in real-time to the terminal | false |
--proxy PROXY |
Use a specified proxy for HTTP requests | None |
-p PLACEHOLDER |
Set a custom placeholder for parameter values | FUZZ |
./paramatrix
__________ _____ __ .__
\______ \_____ ____________ / \ _____ _/ |________|__|__ ___
| ___/\__ \\_ __ \__ \ / \ / \\__ \\ __\_ __ \ \ \/ /
| | / __ \| | \// __ \_/ Y \/ __ \| | | | \/ |> <
|____| (____ /__| (____ /\____|__ (____ /__| |__| |__/__/\_ \
\/ \/ \/ \/ \/
with <3 by @Karthik-HR0
usage: paramatrix [-h] [-d DOMAIN] [-l LIST] [-s] [--proxy PROXY] [-p PLACEHOLDER]
Mining URLs from dark corners of Web Archives
options:
-h, --help show this help message and exit
-d DOMAIN, --domain DOMAIN
Domain name to fetch related URLs for.
-l LIST, --list LIST File containing a list of domain names.
-s, --stream Stream URLs on the terminal.
--proxy PROXY Set the proxy address for web requests.
-p PLACEHOLDER, --placeholder PLACEHOLDER
placeholder for parameter values
Built with ❤️ by @Karthik-HR0