How do I filter medusa results by status code?

Pass positive codes with -cP (for example -cP 200,204,301) and drop codes with -cN (such as 404). Both take a comma-separated list.

Can medusa fuzz for specific file extensions?

Set -e to an extension and medusa appends it to each wordlist entry. Combine it with the directory wordlist you pass to -w.

How do I fuzz many hosts in one run?

Pass a URL file with -uL, one target per line, instead of a single -u. The same wordlist runs against every host and hits land in one output.

What causes a too-many-open-files error?

High concurrency opens many sockets. Raise the file-descriptor limit in the shell before the run, or lower concurrent requests with -conc.

Is this the same medusa as the password brute-forcer?

No. This is riza/medusa, a recursive HTTP content fuzzer. It is a different project from the older medusa parallel network login brute-forcer.

Updated Jul 15, 2026

Fuzzing

Discover hidden directories with recursive HTTP fuzzing

Recursive HTTP directory and file fuzzer.

Discover hidden directories and files Map a deep directory tree in one run Fuzz many hosts from a list

overview

What medusa does

Point -u at a live URL and -w at a directory wordlist. -r descends into discovered directories. -cP and -cN filter status codes; -e appends extensions.

Reach for it when a prober already confirmed the host and you need a deep content tree from one seed without re-running per level.

ffuf covers parameter and vhost modes with richer filtering. medusa stays recursion-first for directory trees. Not the older medusa login brute-forcer.

source github.com/riza/medusa

use cases

Where medusa fits

Discover hidden directories and files

Fuzz a live host with a content wordlist to surface admin panels, backups, and endpoints that are not linked from any page.

Map a deep directory tree in one run

Enable recursive fuzzing so medusa descends into each directory it finds and fuzzes inside it, building a full tree from a single seed URL.

Fuzz many hosts from a list

Feed a URL list so one wordlist runs against every target in the same job, then collect all discovered paths in one output.

Tune hits with status-code filters

Set positive or negative status codes to keep only the responses that matter, cutting redirect and not-found noise out of the results.

reference

medusa inputs and flags

13 inputs

Name	Type	Flag	Description
url	STRING	-u	Single target URL to fuzz.
url-list	FILE	-uL	File of target URLs, one per line, to fuzz many hosts in one run.
wordlist	FILE	-w	Directory wordlist file, one entry per line.
recursive	BOOLEAN	-r	Enable recursive fuzzing into discovered directories.
extension	STRING	-e	Extension appended to each wordlist entry.
positive-status-codes	STRING	-cP	Status codes to keep as hits, separated by commas.
negative-status-codes	STRING	-cN	Status codes to drop, separated by commas.
concurrent	STRING	-conc	Maximum concurrent requests.

Showing key inputs. medusa exposes 13 inputs in total.

Full flag reference (13 inputs)

Name	Type	Flag	Description
cpu	STRING	-cpus	Number of CPU cores to use.
url	STRING	-u	Single target URL to fuzz.
schema	STRING	-s	Force the scheme; defaults to http when the URL has none.
timeout	STRING	-t	HTTP response timeout in seconds (default 10s).
url-list	FILE	-uL	URL list file path, one target per line.
wordlist	FILE	-w	Directory wordlist file, one entry per line.
extension	STRING	-e	Extension appended to each wordlist entry.
recursive	BOOLEAN	-r	Enable recursive fuzzing into discovered directories.
bypass-ssl	BOOLEAN	-x	Bypass SSL certificate verification.
concurrent	STRING	-conc	Maximum number of concurrent requests.
user-agent	STRING	-ua	User-Agent header value to send.
negative-status-codes	STRING	-cN	Negative status codes to drop, separated by commas.
positive-status-codes	STRING	-cP	Positive status codes to keep as hits, separated by commas.

example

Run medusa

medusa · command

# recursive content discovery against a live hostmedusa -u https://example.com -w /wordlists/directory-list.txt -r -e php -cP 200,204,301,302,403

sample output

medusa v0.2.1 by rizasabuncu-----------------------------------------[*] URL/List: https://example.com[*] Recursive fuzz: true-----------------------------------------[200] https://example.com/admin - 4821[301] https://example.com/backup - 0[403] https://example.com/.git/ - 162[200] https://example.com/admin/config.php - 2044[+] Total time:	3.417s

guidance

Choosing medusa

Use medusa for recursive directory discovery on a host you already know is live. Recursion maps a deep tree from one seed. For a richer FUZZ engine with parameter and vhost modes, use ffuf; for a flexible payload framework, use wfuzz.

ffuf

General FUZZ engine with parameter and vhost modes plus response filtering. medusa is leaner and recursion-first.

wfuzz

Flexible fuzzing framework with many payload sources. medusa trades that breadth for recursive directory discovery.

crithit

Directory and file brute forcing built for extreme scale across many hosts at once.

faq

medusa questions

Enable -r and medusa descends into every directory it finds and fuzzes inside it, mapping a deep tree from a single seed URL in one run.

Run medusa yourself

A target URL and a directory wordlist feed medusa, which fuzzes the host recursively and writes the discovered paths as a queryable output.

Run medusa in Trickest Browse the library

Facts on this page come from the live Trickest tool library.

Discover hidden directories with recursive HTTP fuzzing

What medusa does

Where medusa fits

Discover hidden directories and files

Map a deep directory tree in one run

Fuzz many hosts from a list

Tune hits with status-code filters

medusa inputs and flags

Run medusa

Choosing medusa

ffuf

wfuzz

crithit

medusa questions

More Fuzzing tools

ffuf

paramspider

shortscan

crithit

ffuf-virtual-hosts

x8

Run medusa yourself