Unlock the full power and feature of our URL Fuzzer - Discover hidden files and directories! Compare pricing plans and discover more tools and features.
Here is a URL Fuzzer - Discover hidden files and directories sample report:
Discover hidden files and directories (which are not linked in the HTML pages): .conf, .bak, .bkp, .zip, .xls, etc. Get easy access to hidden content hosted on your target web server.
Fuzz the target with your custom wordlist in the specified location.
It is highly likely that you will find sensitive information in the hidden files and directories hosted on the target web server.
This tool also allows you to uncover hidden functionality in web applications (hidden paths), that can be further explored for vulnerabilities.
You can verify if the uncovered files and directories have proper permissions configured and if they leak any sensitive information.
| Parameter | Description |
|---|---|
| Template URL | This is the template URL on the target server that will be fuzzed. You can (optionally) insert your payload in a custom location specified by a 'FUZZ' marker. You can place it in the path or in the query strings, but NOT in the domain or subdomain. The default location is at the end of the URL. Examples: http://example.com/dirs/FUZZ/index.php?id=3 http://example.com/dirs/profiles/user.php?name=FUZZ http://example.com/ |
| Request options - Method | Choose the HTTP method for the requests made (GET or POST) and specify POST data |
| Request options - Custom headers | Specify custom headers to be sent with every request |
| Request options - Retry - Max retries for a request | Maximum number of retries in case of connection error for a HTTP request, default 3 |
| Request options - Retry - Retry delays factor | The delay between retries increases exponentially. The factor can be a float between 0 and 120. If the factor is 1 (default), the first retry is sent immediately (after 0s), the second one after 1s, then 2s, 4s... If the factor is 0.1, the sleeps between the retries are: 0s, 0.1s, 0.2s, 0.4s... |
| Request options - Retry - Force retry on HTTP codes | By default, the retry policy is only applied on connection errors. With this option, you can enforce retrying on responses with these status codes. They can be integers between 100 and 599 |
| Request options - Timing - Number of parallel requests (threads) | Number of threads for this scan, default 7 |
| Request options - Timing - Delay between requests | Thread count must be 1 in order for this to work properly. It represents the delay between the requests (in seconds), default 0 |
| Request options - Timing - Request Timeout | Set the timeout for a HTTP request, measured in seconds, default 4 |
| Payload type - Wordlist | Specify a custom wordlist for the payloads that will replace the 'FUZZ' marker |
| Payload type - Sequence of numbers | Generate a sequence of numbers with a given start, end and step to be used as payload that will replace the 'FUZZ' marker |
| Payload options - Add words from HTML | This option extends the default wordlist with words from the HTML page located at the base URL (including existing links). Non-applicable with the Sequence of numbers payload type |
| Payload options - Extensions | Append different extensions to every item in the input wordlist. You can also specify custom extensions that you want to search for (up to 10 custom extensions per scan), including double extensions (ex. .php.old, .jsp.bak, .tgz, etc) |
| Payload options - Recursion | For each found directory in the URL path, with the status code 200 or 403, start a new search with the initial wordlist. It can go up to three recursion levels. |
| Payload options - Mutate words found | Apply various mutations to the identified files in order to find other resources (ex. config.php, config2.php, config_old.php, config-dev.php, etc) |
| Filter results - Auto | Discard responses with the 404 status code and (only for the GET method) auto-detect soft 404 pages: non-existing resources, error pages, redirects (false positives) |
| Filter results - Manual | Results will be filtered according to the Match/Ignore conditions that you specify |
| Filter results - Match/Ignore HTTP Codes | Match/Ignore responses with the specified status codes. They should be integers between 100 and 599 |
| Filter results - Match/Ignore Response Size | Match/Ignore responses with the size matching the specified condition. The size used for comparing should be an integer between 0 and 10240 and is measured in KB |
| Filter results - Match/Ignore HTML contains string | Match/Ignore responses that contain the specified string in the HTML content |
