> For the complete documentation index, see [llms.txt](https://davidjosearaujo.gitbook.io/online-courses/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidjosearaujo.gitbook.io/online-courses/api-penetration-testing-course/api-reconnaissance/passive-reconnaissance/the-wayback-machine.md).

# The Wayback Machine

The Wayback Machine is an archive of various web pages over time. This is great for passive API reconnaissance because this allows you to check out historical changes to your target. If, for example, the target once advertised a partner API on their landing page, but now hides it behind an authenticated portal, then you might be able to spot that change using the Wayback Machine. Another use case would be to see changes to existing API documentation. If the **API has not been managed well over time**, then there is a chance that you could find retired endpoints that still exist even though the API provider believes them to be retired. These are known as Zombie APIs. **Zombie APIs fall under the Improper Assets Management vulnerability on the OWASP API Security Top 10 list**. Finding and comparing historical snapshots of API documentation can simplify testing for Improper Assets Management.

<figure><img src="https://825333096-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FrbHTUw6JmYWHWgF1IhRj%2Fuploads%2FRGXFF70Iva4RpNAMXQLk%2FFGPF2fPT8ysfQHtTHQbk_Wayback1.png?alt=media&amp;token=8cf2fad8-e577-49f4-a612-7315a84bec77" alt=""><figcaption></figcaption></figure>

Check for differences between the API documentation. Later, when you are actively testing the API, make sure to test using old endpoints.