The Time Machine — Weaponizing WaybackUrls for Recon, BugBounties , OSINT, Sensitive Endpoints and what not

You must have heard about time travel in movies, series and comics. Well here we are Nah i’m not joking you can travel back in time and can fetch the endpoints from web applications to do further exploitation, don’t believe me xD You will after Travelling from TheTimeMachine, PS Doesn’t work offline you need internet to Travel In Time xD.

I have created this tool for making my work easier when it comes to recon and fetching sensitive endpoints for sensitive data exposure and further exploitation using waybackurls aka The Time Machine and sorting for Sensitive endpoints, it has also option to look for sensitive endpoints for information disclosure, It has have more capabilities like looking for possible endpoints vulnerable to XSS, LFI, JIRA Based Vulnerability, Open Redirection.

I’m not too much into bug bounty but recently Managed HOF in NOKIA (Soon will be updated in Website or is already there :P), and found P1 with The Time Machine :

It worked on multiple bug bounty program, reports are still under review 😛

Lets get started.


  1. Search for /api/ endpoint
  2. Search for JSON endpoint
  3. Fetch possible Conf(configuration) endpoint
  4. All Possible Sensitive instances in URL from TheTimeMachine (Searches from Fuzz List) or can also Add your own Custom List
  5. Fetches subdomains from waybackurl
  6. Search Custom keyword of your choice Eg. backup, .log etc.
  7. Attack Mode ( Searched for vulnerable possible endpoints for SQLi, LFI, XSS, Open Redirect, WordPress, JIRA Based Vulnerability or via Custom File, PS More to be added soon )
  8. Fetch only Parameters from any file (Eg. Fetched from way back urls, extracted file from Attack mode or any URLs file, also how creative you are can be used with burp spider file :P)
  9. You can manually edit all the files that searched for XSS, LFI, Fuzz etc.

Read here more:

Github Link :

Leave a Reply