loading
Loading content
loading
Discovery
Domain-derived backup-file URL fuzzer.
overview
fuzzuli hunts exposed backup archives by deriving candidate filenames from each target domain. Transforms include reverse, withoutvowels, withoutdots, mixed, and shuffle. Set -mt all to combine them, then attach -ex extensions such as zip, tar.gz, and sql.
Reach for it after httpx when you want leftover .zip and .sql dumps a static wordlist never names. Keep signal with -sc, -ct, and -cl so wildcard 200s and tiny error pages drop out. Prefer ffuf or feroxbuster for general path brute forcing.
Trickest provides fuzzuli as a managed Discovery node. Feed a host file via -f; take FILE and FOLDER hits into a downloader or report stage. -jw emits the candidate names alone when you want review before any request.
source github.com/musana/fuzzuli
use cases
Point fuzzuli at a host list and let it derive domain-specific filenames, then probe for .zip, .tar.gz, .sql, and .backup files that hold source code or database dumps a generic wordlist would miss.
Run fuzzuli after subdomain enumeration and httpx so it tests only live hosts, generating a fresh candidate list for each domain instead of reusing one static list across the whole estate.
Filter responses by status code, content type, and a minimum content length so a genuine multi-megabyte archive surfaces while wildcard 200s and tiny error pages drop out of the results.
Use just-wordlist mode to produce the domain-derived candidate names alone, then feed them into another fuzzer or review them before any request reaches the target.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| input-file | FILE | -f | Input file containing the list of hosts or domains to fuzz. |
| method | STRING | -mt | Wordlist generation method: regular, withoutdots, withoutvowels, reverse, mixed, withoutdv, shuffle, or all. |
| file-extensions | STRING | -ex | Extensions to test (default rar, zip, tar.gz, tar, gz, jar, 7z, bz2, sql, backup, war). |
| status-code | STRING | -sc | Match responses with the specified status code (default 200). |
| content-length | STRING | -cl | Match responses with at least this content length, e.g. >100 (default 100). |
| http-method | STRING | -hm | HTTP method used to probe each candidate (default HEAD). |
| worker-count | STRING | -w | Number of concurrent workers (default 16). |
| just-wordlist | BOOLEAN | -jw | Generate the wordlist only, without sending any HTTP requests. |
Showing key inputs. fuzzuli exposes 21 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| paths | STRING | -pt | Paths to fuzz, comma-separated for multiple, e.g. /,/db/,/old/ (default "/"). |
| method | STRING | -mt | Wordlist generation method: regular, withoutdots, withoutvowels, reverse, mixed, withoutdv, shuffle, or all. |
| prefix | STRING | -pf | Prefix to add to generated URLs. |
| remove | STRING | -rm | Remove the specified character from candidate names. |
| silent | BOOLEAN | -sl | Silent mode; print results only. |
| suffix | STRING | -sf | Suffix to add to generated URLs. |
| exclude | STRING | -es | Exclude domains containing the given string or char; supports the OR operand, e.g. google|bing|yahoo (default "#"). |
| replace | STRING | -rp | Replace the specified character in candidate names. |
| timeout | STRING | -to | Request timeout in seconds (default 10). |
| http-proxy | STRING | -px | HTTP proxy to route requests through. |
| input-file | FILE | -f | Input file containing a list of hosts or domains to fuzz. |
| print-urls | BOOLEAN | -p | Print every URL a request is sent to. |
| user-agent | STRING | -ua | User-Agent header to send (default a Firefox 100 string). |
| http-method | STRING | -hm | HTTP method used to probe each candidate (default HEAD). |
| status-code | STRING | -sc | Match responses with the specified status code (default 200). |
| content-type | STRING | -ct | Match responses with the specified content type. |
| worker-count | STRING | -w | Number of concurrent workers (default 16). |
| domain-length | STRING | -dl | Match domains up to the specified length (default 40). |
| just-wordlist | BOOLEAN | -jw | Generate the wordlist only, without sending any HTTP requests. |
| content-length | STRING | -cl | Match responses with at least this content length, e.g. >100 (default 100). |
| file-extensions | STRING | -ex | Extensions to test (default rar, zip, tar.gz, tar, gz, jar, 7z, bz2, sql, backup, war). |
example
# derive per-host backup names and probe with strict matchingfuzzuli -f hosts.txt -mt all -ex zip,tar.gz,sql -sc 200 -cl >1000 -w 24https://example.com/example.zip 200 5242880https://example.com/elpmaxe.tar.gz 200 1048576https://shop.example.com/pohs.sql 200 262144https://api.example.com/ipa.backup 200 786432https://dev.example.com/ved.rar 200 3145728https://staging.example.com/gnigats.war 200 4194304guidance
Use fuzzuli when the goal is exposed backup and archive files and the wordlist should come from each domain. For general directory and file brute forcing with a fixed wordlist, use ffuf or feroxbuster. For known sensitive paths, run a content-discovery scan instead.
General-purpose web fuzzer with a fixed wordlist and rich matchers. fuzzuli derives backup-file names per domain instead.
Recursive content discovery in Rust. Broader path brute forcing, not backup-name generation.
Directory and file brute forcer for general content discovery. No domain-derived wordlist.
faq
related
Extract URLs and endpoints from Android APK files.
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
A domain list is probed by httpx for live hosts, then fuzzuli derives backup-file names per host and writes the matching archives as a queryable output.
Facts on this page come from the live Trickest tool library.