# Urlhunter | A Recon Tool That Allows Searching On URLs That Are Exposed Via Shortener Services

**URL:** <https://onehack.st/t/urlhunter-a-recon-tool-that-allows-searching-on-urls-that-are-exposed-via-shortener-services/178211>\
**Category:** Tools & Scripts\
**Tags:** tools, freebies\
**Created:** [April 9, 2021, 10:53am UTC](https://onehack.st/t/urlhunter-a-recon-tool-that-allows-searching-on-urls-that-are-exposed-via-shortener-services/178211 "2021-04-09T10:53:20Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheStrength](https://onehack.st/user_avatar/onehack.st/thestrength/32/46753_2.png) [@TheStrength](https://onehack.st/u/TheStrength)\
**Post date:** [April 9, 2021, 10:53am UTC](https://onehack.st/t/urlhunter-a-recon-tool-that-allows-searching-on-urls-that-are-exposed-via-shortener-services/178211/1 "2021-04-09T10:53:20Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/2/c/2cd048e0e51e50659bcc9bf77b0eeaa626d92075.jpeg)

urlhunter is a recon tool that allows searching on URLs that are exposed via shortener services such as bit.ly and goo.gl. The project is written in Go.

**How?**

A group named [URLTeam](https://archiveteam.org/index.php?title=URLTeam) (kudos to them) are brute forcing the URL shortener services and publishing matched results on a daily basis. urlhunter downloads their [collections](https://archive.org/details/UrlteamWebCrawls) and lets you analyze them.

**Installation**

**From Binary**

You can download the pre-built binaries from the [releases](https://github.com/utkusen/urlhunter/releases/latest) page and run. For example:

`tar xzvf urlhunter_0.1.0_Linux_amd64.tar.gz`

`./urlhunter --help`

**From Source**

1. Install Go on your system
2. Run: `go get -u github.com/utkusen/urlhunter`

**Note For The Windows Users:** urlhunter uses `XZ Utils` which is pre-installed on Linux and macOS systems. For Windows systems, you need to download it from [https://tukaani.org/xz/](https://tukaani.org/xz/)

**Usage**

urlhunter requires 3 parameters to run: `-keywords`, `-date` and `-o`.

For example: `urlhunter -keywords keywords.txt -date 2020-11-20 -o out.txt`

**-keywords**

You need to specify the txt file that contains keywords to search on URLs. Keywords must be written line by line. You have three different ways to specify keywords:

**Single Keyword:** urlhunter will search the given keyword as a substring. For example:

`acme.com` keyword will both match `https://acme.com/blabla` and `https://another.com/?referrer=acme.com`

**Multiple Keywords:** urlhunter will search the given keywords with an `AND` logic. Which means, a URL must include all the provided keywords. Keywords must be separated with `,` character. For example:

`acme.com,admin` will match `https://acme.com/secret/adminpanel` but _ **won’t** _ match `https://acme.com/somethingelse`

**Regex Values:** urlhunter will search for the given regex value. In the keyword file, the line that contains a regular expression formula must start with `regex `string. The format is: `regex REGEXFORMULA`. For example:

`regex 1d{10}` will match `https://example.com/index.php?id=12938454312` but _ **won’t** _ match `https://example.com/index.php?id=abc223`

**-date**

urlhunter downloads the archive files of the given date(s). You have three different ways to specify the date:

**Latest:** urlhunter will download the latest archive. `-date latest`

**Single Date:** urlhunter will download the archive of the given date. Date format is YYYY-MM-DD.

For example: `-date 2020-11-20`

**Date Range:** urlhunter will download all the archives between given start and end dates.

For example: `-date 2020-11-10:2020-11-20`

**-o**

You can specify the output file with `-o` parameter. For example `-o out.txt`

**Demonstration Video**

**The Speed Problem**

[Archive.org](http://Archive.org) throttles the speed when downloading files. Therefore, downloading an archive takes more time than usual. As a workaround, you can download the archives via Torrent and put them under the `archive/` folder which is located in the same directory with the urlhunter’s binary. The directory tree will look like:

```auto
|-urlhunter|---urlhunter(binary)|---archive|-----urlteam_2020-11-20-11-17-04|-----urlteam_2020-11-17-11-17-04

```

**Example Use Cases**

urlhunter might be useful for cyber intelligence and bug bounty purposes. For example:

`docs.google.com/a/acme.com` `drive.google.com/a/acme.com` keywords allow you to find public Google Docs&Drive share links of Acme company.

`acme.com,password_reset_token` keyword may allow you to find the working password reset tokens of [acme.com](http://acme.com)

`trello.com` allows you to find public Trello addresses.

**Thanks**

Special thanks to Samet([@cyanpiny](https://twitter.com/cyanpiny)) who gave me the idea of this tool.

## GitHub:

> **[GitHub - utkusen/urlhunter: a recon tool that allows searching on URLs that...](https://github.com/utkusen/urlhunter)**
>
> a recon tool that allows searching on URLs that are exposed via shortener services