Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Discovery

Probe hosts for domain-derived backup archives

Domain-derived backup-file URL fuzzer.

Agent
Find leftover backup archivesSweep a discovered attack surfaceCut false positives with strict matching

overview

What fuzzuli does

fuzzuli hunts exposed backup archives by deriving candidate filenames from each target domain. Transforms include reverse, withoutvowels, withoutdots, mixed, and shuffle. Set -mt all to combine them, then attach -ex extensions such as zip, tar.gz, and sql.

Reach for it after httpx when you want leftover .zip and .sql dumps a static wordlist never names. Keep signal with -sc, -ct, and -cl so wildcard 200s and tiny error pages drop out. Prefer ffuf or feroxbuster for general path brute forcing.

Trickest provides fuzzuli as a managed Discovery node. Feed a host file via -f; take FILE and FOLDER hits into a downloader or report stage. -jw emits the candidate names alone when you want review before any request.

source github.com/musana/fuzzuli

use cases

Where fuzzuli fits

Find leftover backup archives

Point fuzzuli at a host list and let it derive domain-specific filenames, then probe for .zip, .tar.gz, .sql, and .backup files that hold source code or database dumps a generic wordlist would miss.

Sweep a discovered attack surface

Run fuzzuli after subdomain enumeration and httpx so it tests only live hosts, generating a fresh candidate list for each domain instead of reusing one static list across the whole estate.

Cut false positives with strict matching

Filter responses by status code, content type, and a minimum content length so a genuine multi-megabyte archive surfaces while wildcard 200s and tiny error pages drop out of the results.

Generate wordlists without sending traffic

Use just-wordlist mode to produce the domain-derived candidate names alone, then feed them into another fuzzer or review them before any request reaches the target.

reference

fuzzuli inputs and flags

21 inputs
NameTypeFlagDescription
input-fileFILE-fInput file containing the list of hosts or domains to fuzz.
methodSTRING-mtWordlist generation method: regular, withoutdots, withoutvowels, reverse, mixed, withoutdv, shuffle, or all.
file-extensionsSTRING-exExtensions to test (default rar, zip, tar.gz, tar, gz, jar, 7z, bz2, sql, backup, war).
status-codeSTRING-scMatch responses with the specified status code (default 200).
content-lengthSTRING-clMatch responses with at least this content length, e.g. >100 (default 100).
http-methodSTRING-hmHTTP method used to probe each candidate (default HEAD).
worker-countSTRING-wNumber of concurrent workers (default 16).
just-wordlistBOOLEAN-jwGenerate the wordlist only, without sending any HTTP requests.

Showing key inputs. fuzzuli exposes 21 inputs in total.

Full flag reference (21 inputs)
NameTypeFlagDescription
pathsSTRING-ptPaths to fuzz, comma-separated for multiple, e.g. /,/db/,/old/ (default "/").
methodSTRING-mtWordlist generation method: regular, withoutdots, withoutvowels, reverse, mixed, withoutdv, shuffle, or all.
prefixSTRING-pfPrefix to add to generated URLs.
removeSTRING-rmRemove the specified character from candidate names.
silentBOOLEAN-slSilent mode; print results only.
suffixSTRING-sfSuffix to add to generated URLs.
excludeSTRING-esExclude domains containing the given string or char; supports the OR operand, e.g. google|bing|yahoo (default "#").
replaceSTRING-rpReplace the specified character in candidate names.
timeoutSTRING-toRequest timeout in seconds (default 10).
http-proxySTRING-pxHTTP proxy to route requests through.
input-fileFILE-fInput file containing a list of hosts or domains to fuzz.
print-urlsBOOLEAN-pPrint every URL a request is sent to.
user-agentSTRING-uaUser-Agent header to send (default a Firefox 100 string).
http-methodSTRING-hmHTTP method used to probe each candidate (default HEAD).
status-codeSTRING-scMatch responses with the specified status code (default 200).
content-typeSTRING-ctMatch responses with the specified content type.
worker-countSTRING-wNumber of concurrent workers (default 16).
domain-lengthSTRING-dlMatch domains up to the specified length (default 40).
just-wordlistBOOLEAN-jwGenerate the wordlist only, without sending any HTTP requests.
content-lengthSTRING-clMatch responses with at least this content length, e.g. >100 (default 100).
file-extensionsSTRING-exExtensions to test (default rar, zip, tar.gz, tar, gz, jar, 7z, bz2, sql, backup, war).

example

Run fuzzuli

fuzzuli · command
# derive per-host backup names and probe with strict matchingfuzzuli -f hosts.txt -mt all -ex zip,tar.gz,sql -sc 200 -cl >1000 -w 24
sample output
https://example.com/example.zip          200    5242880https://example.com/elpmaxe.tar.gz       200    1048576https://shop.example.com/pohs.sql        200     262144https://api.example.com/ipa.backup       200     786432https://dev.example.com/ved.rar          200    3145728https://staging.example.com/gnigats.war  200    4194304

guidance

Choosing fuzzuli

Use fuzzuli when the goal is exposed backup and archive files and the wordlist should come from each domain. For general directory and file brute forcing with a fixed wordlist, use ffuf or feroxbuster. For known sensitive paths, run a content-discovery scan instead.

ffuf

General-purpose web fuzzer with a fixed wordlist and rich matchers. fuzzuli derives backup-file names per domain instead.

feroxbuster

Recursive content discovery in Rust. Broader path brute forcing, not backup-name generation.

gobuster

Directory and file brute forcer for general content discovery. No domain-derived wordlist.

faq

fuzzuli questions

It reads the target domain and derives candidate filenames, applying methods such as reverse, withoutvowels, withoutdots, mixed, and shuffle. Set the method with -mt, or use -mt all to combine every transform.

related

More Discovery tools

  1. apkurlgrep

    Extract URLs and endpoints from Android APK files.

  2. cariddi

    Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.

  3. crawlergo

    Browser-driven crawler that harvests requests for downstream scanners.

  4. dirsearch

    Web path scanner.

  5. fallparams

    Crawl pages, harvest potential parameters, write a custom wordlist.

  6. feroxbuster

    Recursive content discovery with smart defaults and rich response filters.

Run fuzzuli yourself

A domain list is probed by httpx for live hosts, then fuzzuli derives backup-file names per host and writes the matching archives as a queryable output.

Open fuzzuli in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.