Skip to main content

​
Overview

The URL Fuzzer discovers hidden content on web servers by testing file and directory names from wordlists. It finds backup files, admin panels, configuration files, and other resources not linked from the main application. The URL Fuzzer is a discovery tool: it identifies hidden resources but does not test them for vulnerabilities. It does not add data to your Attack Surface or generate findings.

​
Scan types

Scan typeWordlist sizeFeatures
Light146 wordsQuick scan with mutation enabled, no dynamic wordlist
Deep43,005 wordsComprehensive scan with dynamic wordlist and mutation enabled
CustomVariableFull control over all parameters

​
Parameters

​
Target

The URL to fuzz. You can optionally specify where to insert payloads using the FUZZ marker: 
http://example.com/dirs/FUZZ/index.php?id=3
http://example.com/dirs/profiles/user.php?name=FUZZ
http://example.com/  (FUZZ is added at the end automatically)
The FUZZ marker can be placed in the URL path or query string, but not in the hostname. Only one FUZZ marker is allowed per scan.

​
Request options (Custom scan only)

OptionDescriptionDefault
MethodHTTP method (GET or POST)GET
POST dataPOST body data, can contain FUZZ marker-
Custom headersAdditional headers sent with each request-
Thread countNumber of parallel requests (1-10)7
Request timeoutTimeout per request in seconds (0-43,200)4
Delay between requestsDelay in seconds (only when thread count is 1)0
Max retriesMaximum retries on connection error (0-10)3
Retry delay factorExponential backoff factor (0-120)1
Force retry on HTTP codesStatus codes that trigger a retry (e.g., 429, 500-505)-

​
Payload options (Custom scan only)

​
Payload type

TypeDescription
WordlistUse a wordlist file. Select from default wordlists or your own custom wordlists.
SequenceGenerate a numeric sequence with configurable start, end, and step values (max 50,000 numbers).

​
Extension categories

Each wordlist entry is tested with selected extension categories appended:
CategoryExtensions
No extensionTests entries as-is (directories, extensionless files)
Configuration files.conf, .cfg, .txt, .xml, .json, .ini
Source code files.bat, .c, .java, .cpp, .cs, .h
Archives.zip, .tar, .tar.gz, .tgz, .gz, .7z, .bzip, .rar, .jar, .apk
Database files.sql, .mdb, .db, .nsf, .csv, .dbf
Logs.log, .err, .journal
Backup files.old, .back, .bkp, .bak, .tmp, .test, .dev, .prod
Documents.doc, .docx, .odt, .xls, .xlsx, .rtf, .pdf, .ppt, .pptx
Web files.asp, .aspx, .php, .jsp, .shtml, .htm, .html, .dll, .pl, .py, .cgi, .cfm, .sh, .js
Custom extensionsYour own extensions (up to 10, max 10 characters each)

​
Additional options

OptionDescription
Add words from HTMLExtends the wordlist with words extracted from the target page (links, text). Enabled by default for Deep scans.
Mutate words foundGenerates variations of discovered files (e.g., config.php → config2.php, config_old.php, config-dev.php, config.php.bak). Enabled by default.
RecursionFor each discovered directory (status 200 or 403), starts a new search with the original wordlist. Up to 3 levels deep.

​
Response filtering (Custom scan only)

ModeDescription
AutoDiscards 404 responses and auto-detects soft 404 pages (error pages that return 200, redirects to login, etc.)
ManualApply custom match/ignore conditions

​
Manual filter conditions

ConditionMatchIgnore
HTTP codesOnly show responses with these codes (e.g., 200-205,301)Discard responses with these codes
Response sizeOnly show responses matching size condition (e.g., < 2 KB)Discard responses matching size condition
Content containsOnly show responses containing this stringDiscard responses containing this string
Use Auto filtering for most scans. Switch to Manual when you need precise control over which responses to include, such as filtering out a specific response size that generates false positives.

​
How it works

1

Parse target URL

The fuzzer identifies where to insert payloads. If no FUZZ marker is specified, it’s added at the end of the URL path.
2

Prepare wordlist

Loads the selected wordlist. If “Add words from HTML” is enabled, extracts additional words from the target page (links, text content) and prepends them to the wordlist.
3

Fuzz each extension category

For each selected extension category, sends requests for every word in the wordlist with the extension appended.
4

Filter responses

In Auto mode, discards 404 pages and detects soft 404s using an in-house heuristic detector. An AI classifier then runs a second pass on any response the heuristic marks as valid, to reduce false positives. In Manual mode, applies custom match/ignore conditions.
5

Recursion (if enabled)

For each discovered directory with status 200 or 403, starts a new scan using the original wordlist. Repeats up to the configured depth.
6

Mutation (if enabled)

Generates variations of discovered filenames and tests them to find related files.

​
Mutation patterns

When mutation is enabled, the fuzzer generates variations like:
OriginalMutations generated
config.phpconfig.php.old, config.php.bak, config.php.bkp
data.sqldata1.sql, data2.sql, …, data10.sql
admin/admin-old/, admin_dev/, admin-test/, admins/
Suffixes used: 1-10, old, back, bkp, bak, tmp, test, dev, prod Separators used: none, -, _

​
Authentication

For scanning authenticated endpoints, add custom headers in Custom scan mode:
  1. Select Custom scan type
  2. Navigate to Request options > Headers
  3. Add your authentication headers
Example headers: 
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Cookie: session_id=abc123; JSESSIONID=xyz789
X-API-Key: your-api-key-here
For session-based authentication, capture the session cookie from your browser’s developer tools after logging in.
See the authenticated scanning guide for detailed instructions.

​
Follow-up actions

Based on discovered content:
DiscoveryRecommended action
Any discovered page (admin panels, login pages, etc.)Test with Website Scanner
API endpoints, Swagger docsRun API Scanner
Configuration filesReview for exposed credentials and sensitive data
.git directoryExtract and analyze the repository for secrets
Any web contentRun Website Recon for technology fingerprinting
Indexed content suspectedUse Google Hacking to find publicly indexed sensitive content