URL Recon Analyzer
Paste a list of URLs from a crawl or archive and get them de-duplicated and grouped by host, endpoint pattern, file type and parameter, with hints on what deserves a look.
Runs in your browser Your input never leaves your device.
Endpoint patterns (IDs folded together)
Parameters
URLs are read in your browser. Nothing is requested or sent. The hints are labels on the text (a parameter called redirect, a path called admin): they point at what to look at, they do not show anything is vulnerable.
Report a problem with this tool
About this tool
Crawlers and archive tools can hand you tens of thousands of URLs, most of them duplicates or variations of the same few endpoints. This tool reads that list in your browser and makes it workable. Each line is parsed with the browser's URL rules, default ports and fragments are dropped, hosts are lowercased and exact duplicates are removed (optionally treating parameters in a different order as the same). Path parts that look like identifiers, such as numbers, UUIDs, dates and long hex or token strings, are folded into patterns, so /users/1001/orders and /users/1002/orders count as one endpoint. You get counts per host, file type, hint and parameter name, a table of endpoint patterns with an example of each, and a table of parameters with how many different values were seen. Hints are plain labels on the text: backup or dump files such as .sql or .bak, config and key files, source maps, admin, login, API, API documentation, debug and version-control paths, and parameters named like redirects, file paths, object IDs, commands, secrets, or debug switches, plus values that are themselves URLs or contain path traversal. They tell you where to look first; they do not show that anything is vulnerable, and nothing is requested. Click a host, hint or file type to filter the list, search within it, and copy the URLs, the host list, the parameter names or a CSV. Lines that are not http or https URLs are listed as skipped, a trailing status column such as [200] is ignored, and up to 100,000 lines are read. Parsing was compared with Python's urllib on hundreds of URLs. Nothing leaves your browser.
How to use it
- Paste URLs, one per line, or load a text file.
- Pick whether lines without a scheme should be read as https or http.
- Read the summary, then click a host, hint or file type to filter the list.
- Copy the URLs, hosts or parameter names, or download a CSV.
Common problems
- Many lines are skipped
- Open the skipped list. Only http and https URLs are read; other schemes, plain text and over-long lines are left out.
- Two URLs I expected to be one still count twice
- Turn on sorting of parameters if only the order differs. Different values or paths are kept apart on purpose; the endpoint patterns table groups them.
- A hint seems wrong
- Hints match words in the path or parameter name only. A parameter called id is a hint to check object access, not proof of a problem.