Skip to main content

​
Overview

The URL Fuzzer discovers hidden content on web servers by testing file and directory names from wordlists. It finds backup files, admin panels, configuration files, and other resources not linked from the main application. The URL Fuzzer is a discovery tool: it identifies hidden resources but does not test them for vulnerabilities. It does not add data to your Attack Surface or generate findings.

​
Scan types

​
Parameters

​
Target

The URL to fuzz. You can optionally specify where to insert payloads using the FUZZ marker:
The FUZZ marker can be placed in the URL path or query string, but not in the hostname. Only one FUZZ marker is allowed per scan.

​
Request options (Custom scan only)

​
Payload options (Custom scan only)

​
Payload type

​
Extension categories

Each wordlist entry is tested with selected extension categories appended:

​
Additional options

​
Response filtering (Custom scan only)

​
Manual filter conditions

Use Auto filtering for most scans. Switch to Manual when you need precise control over which responses to include, such as filtering out a specific response size that generates false positives.

​
How it works

1

Parse target URL

The fuzzer identifies where to insert payloads. If no FUZZ marker is specified, it’s added at the end of the URL path.
2

Prepare wordlist

Loads the selected wordlist. If “Add words from HTML” is enabled, extracts additional words from the target page (links, text content) and prepends them to the wordlist.
3

Fuzz each extension category

For each selected extension category, sends requests for every word in the wordlist with the extension appended.
4

Filter responses

In Auto mode, discards 404 pages and detects soft 404s using an in-house heuristic detector. The ML Classifier then runs a second pass on any response the heuristic marks as valid, to reduce false positives. In Manual mode, applies custom match/ignore conditions.
5

Recursion (if enabled)

For each discovered directory with status 200 or 403, starts a new scan using the original wordlist. Repeats up to the configured depth.
6

Mutation (if enabled)

Generates variations of discovered filenames and tests them to find related files.

​
Mutation patterns

When mutation is enabled, the fuzzer generates variations like: Suffixes used: 1-10, old, back, bkp, bak, tmp, test, dev, prod Separators used: none, -, _

​
Authentication

For scanning authenticated endpoints, add custom headers in Custom scan mode:
  1. Select Custom scan type
  2. Navigate to Request options > Headers
  3. Add your authentication headers
Example headers:
For session-based authentication, capture the session cookie from your browser’s developer tools after logging in.
See the authenticated scanning guide for detailed instructions.

​
Follow-up actions

Based on discovered content: