Find exposed backup files with a domain-derived wordlist

fuzzuli hunts for exposed backup files, the ones developers leave behind when they zip up a site or dump a database before a change. Instead of running a static wordlist, it reads the target domain and generates candidate filenames from it on the fly, applying transforms like reversing the name, dropping vowels, dropping dots, and shuffling characters. A site at example.com gets probed for example.zip, elpmaxe.tar.gz, exmpl.sql, and dozens of other domain-derived variants that a generic list would never contain.

The matching side is built for signal. fuzzuli sends HEAD requests by default to stay light, then keeps only responses that match the status code, content type, and minimum content length you set, so a real archive stands out from a 200-everything wildcard. Methods, prefixes, suffixes, file extensions, and the worker count are all tunable, and a just-wordlist mode lets you generate the candidate names without firing a single request.

On Trickest, fuzzuli is a Discovery node that takes a file of hosts and writes a file and a folder of results. Run it after subdomain enumeration and HTTP probing so it targets live hosts, then chain its findings into a downloader or a reporting stage. Because the wordlist is derived per domain, it scales across a large host list without you hand-curating names for each one.