How do I filter medusa results by status code?

Pass positive status codes with -cP to keep only the responses you care about, for example -cP 200,204,301. Use -cN to drop codes such as 404 and 302. Both take a comma-separated list.

Can medusa fuzz for specific file extensions?

Yes. Set -e to an extension and medusa appends it to each wordlist entry, so a list of names becomes a list of files. Combine it with the directory wordlist you pass to -w.

How do I fuzz many hosts in one run?

Give medusa a file of URLs with -uL, one target per line, instead of a single -u. It runs the same wordlist against every host and collects the hits in one output.

medusa throws a too-many-open-files error. What do I do?

At high concurrency medusa opens a lot of sockets. Raise the file-descriptor limit with ulimit -n 8129 before you run it, or lower the concurrent request count with -conc.

Is this the same medusa as the password brute-forcer?

No. This is riza/medusa, a recursive HTTP content fuzzer for directories and files. It is a different project from the older medusa parallel network login brute-forcer that cracks service credentials.

Updated Jul 15, 2026

Fuzzing

Fuzz a host recursively for hidden directories and files

Fastest recursive HTTP fuzzer, like a Ferrari.

Discover hidden directories and files Map a deep directory tree in one run Fuzz many hosts from a list

overview

What medusa does

medusa fuzzes a target over HTTP by walking a directory wordlist against a URL and reading back the status of each request. It is built for content discovery: pointed at a host with a wordlist, it surfaces the directories and files that are present but not linked anywhere on the site. The engine is tuned for speed, so it covers a large wordlist quickly while you keep the request rate under control.

Its signature feature is recursion. Turn on recursive fuzzing and medusa descends into every directory it finds and fuzzes inside it, mapping a deep tree from a single seed URL without you re-running the tool per level. Positive and negative status-code filters decide which responses count as hits, and a forced schema lets you fuzz hosts supplied without a scheme.

On Trickest, medusa is a Fuzzing node that takes a target URL and a directory wordlist and writes a folder and a file of results. Run it after a prober confirms a host is live, then pass the discovered paths to a crawler or scanner so the next stage works from real, reachable content.

source github.com/riza/medusa

use cases

Where medusa fits

Discover hidden directories and files

Fuzz a live host with a content wordlist to surface admin panels, backups, and endpoints that are not linked from any page.

Map a deep directory tree in one run

Enable recursive fuzzing so medusa descends into each directory it finds and fuzzes inside it, building a full tree from a single seed URL.

Fuzz many hosts from a list

Feed a URL list so one wordlist runs against every target in the same job, then collect all discovered paths in one output.

Tune hits with status-code filters

Set positive or negative status codes to keep only the responses that matter, cutting redirect and not-found noise out of the results.

reference

medusa inputs and flags

13 inputs

Name	Type	Flag	Description
url	STRING	-u	Single target URL to fuzz.
url-list	FILE	-uL	File of target URLs, one per line, to fuzz many hosts in one run.
wordlist	FILE	-w	Directory wordlist file, one entry per line.
recursive	BOOLEAN	-r	Enable recursive fuzzing into discovered directories.
extension	STRING	-e	Extension appended to each wordlist entry.
positive-status-codes	STRING	-cP	Status codes to keep as hits, separated by commas.
negative-status-codes	STRING	-cN	Status codes to drop, separated by commas.
concurrent	STRING	-conc	Maximum concurrent requests.

Showing key inputs. medusa exposes 13 inputs in total.

Full flag reference (13 inputs)

Name	Type	Flag	Description
cpu	STRING	-cpus	Number of CPU cores to use.
url	STRING	-u	Single target URL to fuzz.
schema	STRING	-s	Force the scheme; defaults to http when the URL has none.
timeout	STRING	-t	HTTP response timeout in seconds (default 10s).
url-list	FILE	-uL	URL list file path, one target per line.
wordlist	FILE	-w	Directory wordlist file, one entry per line.
extension	STRING	-e	Extension appended to each wordlist entry.
recursive	BOOLEAN	-r	Enable recursive fuzzing into discovered directories.
bypass-ssl	BOOLEAN	-x	Bypass SSL certificate verification.
concurrent	STRING	-conc	Maximum number of concurrent requests.
user-agent	STRING	-ua	User-Agent header value to send.
negative-status-codes	STRING	-cN	Negative status codes to drop, separated by commas.
positive-status-codes	STRING	-cP	Positive status codes to keep as hits, separated by commas.

example

Run medusa

medusa · command

# recursive content discovery against a live hostmedusa -u https://example.com -w /wordlists/directory-list.txt -r -e php -cP 200,204,301,302,403

sample output

medusa v0.2.1 by rizasabuncu-----------------------------------------[*] URL/List: https://example.com[*] Recursive fuzz: true-----------------------------------------[200] https://example.com/admin - 4821[301] https://example.com/backup - 0[403] https://example.com/.git/ - 162[200] https://example.com/admin/config.php - 2044[+] Total time:	3.417s

guidance

Choosing medusa

Reach for medusa when you want fast, recursive directory discovery against a host you already know is live. Recursion maps a deep tree from one seed without re-running per level. For a richer FUZZ engine with parameter and vhost modes, use ffuf; for a flexible payload framework, use wfuzz.

ffuf

General FUZZ engine with parameter and vhost modes plus response filtering. medusa is leaner and recursion-first.

wfuzz

Flexible fuzzing framework with many payload sources. medusa trades that breadth for raw recursive speed.

crithit

Directory and file brute forcing built for extreme scale across many hosts at once.

faq

medusa questions

Turn on recursive fuzzing with -r and medusa descends into every directory it finds and fuzzes inside it, mapping a deep tree from a single seed URL in one run.

Run medusa yourself

A target URL and a directory wordlist feed medusa, which fuzzes the host recursively and writes the discovered paths as a queryable output.

Run medusa in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

url

STRING

-u

Single target URL to fuzz.

url-list

FILE

-uL

File of target URLs, one per line, to fuzz many hosts in one run.

wordlist

FILE

-w

Directory wordlist file, one entry per line.

recursive

BOOLEAN

-r

Enable recursive fuzzing into discovered directories.

extension

STRING

-e

Extension appended to each wordlist entry.

positive-status-codes

STRING

-cP

Status codes to keep as hits, separated by commas.

negative-status-codes

STRING

-cN

Status codes to drop, separated by commas.

concurrent

STRING

-conc

Maximum concurrent requests.

Name

Type

Flag

Description

cpu

STRING

-cpus

Number of CPU cores to use.

url

STRING

-u

Single target URL to fuzz.

schema

STRING

-s

Force the scheme; defaults to http when the URL has none.

timeout

STRING

-t

HTTP response timeout in seconds (default 10s).

url-list

FILE

-uL

URL list file path, one target per line.

wordlist

FILE

-w

Directory wordlist file, one entry per line.

extension

STRING

-e

Extension appended to each wordlist entry.

recursive

BOOLEAN

-r

Enable recursive fuzzing into discovered directories.

bypass-ssl

BOOLEAN

-x

Bypass SSL certificate verification.

concurrent

STRING

-conc

Maximum number of concurrent requests.

user-agent

STRING

-ua

User-Agent header value to send.

negative-status-codes

STRING

-cN

Negative status codes to drop, separated by commas.

positive-status-codes

STRING

-cP

Positive status codes to keep as hits, separated by commas.

medusa v0.2.1 by rizasabuncu-----------------------------------------[*] URL/List: https://example.com[*] Recursive fuzz: true-----------------------------------------[200] https://example.com/admin - 4821[301] https://example.com/backup - 0[403] https://example.com/.git/ - 162[200] https://example.com/admin/config.php - 2044[+] Total time: 3.417s

Fuzz a host recursively for hidden directories and files

What medusa does

Where medusa fits

Discover hidden directories and files

Map a deep directory tree in one run

Fuzz many hosts from a list

Tune hits with status-code filters

medusa inputs and flags

Run medusa

Choosing medusa

ffuf

wfuzz

crithit

medusa questions

More Fuzzing tools

crithit

ffuf

ffuf-multi

ffuf-multi-od

ffuf-od

ffuf-virtual-hosts

Run medusa yourself

Fuzz a host recursively for hidden directories and files

What medusa does

Where medusa fits

Discover hidden directories and files

Map a deep directory tree in one run

Fuzz many hosts from a list

Tune hits with status-code filters

medusa inputs and flags

Run medusa

Choosing medusa

ffuf

wfuzz

crithit

medusa questions

More Fuzzing tools

crithit

ffuf

ffuf-multi

ffuf-multi-od

ffuf-od

ffuf-virtual-hosts

Run medusa yourself