How do I get nested paths?

Raise -l. Level 1 produces single-segment paths; higher levels nest segments so brute forcing reaches deeper routes.

Can I run it across many domains?

Yes. Use -df with one domain per line to build path lists for every host in one pass.

When should I use -only-dirs versus -only-files?

Use -only-dirs to keep folder probes. Use -only-files when you want filenames appended for file guessing. Split passes when triage is noisy.

How does mkpath differ from mksub?

mkpath builds URL paths for HTTP fuzzing. mksub builds subdomain hostnames for DNS resolution.

Updated Jul 15, 2026

Utilities

Shape URL path lists before content discovery

URL path lists from a wordlist for content discovery.

Seed a content-discovery fuzzer Build deep nested paths Split directory and file candidates

overview

What mkpath does

mkpath turns a wordlist into URL path candidates so fuzzers start from a shaped list instead of raw tokens.

Control depth with -l, lowercase with -lower, filter with -r, and choose -only-dirs or -only-files. Pass a host with -d or many hosts with -df.

Trickest provides mkpath as a managed Utilities node ahead of ffuf or feroxbuster. It writes paths; it does not send requests.

source github.com/trickest/mkpath

use cases

Where mkpath fits

Seed a content-discovery fuzzer

Generate a path list from a curated wordlist, then hand it to ffuf or feroxbuster so the fuzzing run hits paths tuned to the target rather than a generic dictionary.

Build deep nested paths

Raise the level flag to produce multi-segment paths so directory brute forcing reaches nested routes that a single-segment list would never test.

Split directory and file candidates

Use only-dirs or only-files to separate folder probing from filename guessing, keeping each fuzzing pass focused and faster to triage.

Filter a noisy wordlist

Apply a regex and lowercasing to strip unwanted entries and collapse duplicates before the paths ever reach a fuzzer.

reference

mkpath inputs and flags

8 inputs

Name	Type	Flag	Description
level	STRING	-l	Path depth to generate (default 1)
lower	BOOLEAN	-lower	Convert wordlist file content to lowercase
regex	STRING	-r	Regex to filter words from wordlist file
domain	STRING	-d	Input domain
wordlist	FILE	-w	Wordlist file
only-dirs	BOOLEAN	-only-dirs	Generate directories only, files are filtered out
only-files	BOOLEAN	-only-files	Generate files only, file names are appended to given domains

Showing key inputs. mkpath exposes 8 inputs in total.

Full flag reference (8 inputs)

Name	Type	Flag	Description
level	STRING	-l	Path depth to generate (default 1)
lower	BOOLEAN	-lower	Convert wordlist file content to lowercase
regex	STRING	-r	Regex to filter words from wordlist file
domain	STRING	-d	Input domain
wordlist	FILE	-w	Wordlist file
only-dirs	BOOLEAN	-only-dirs	Generate directories only, files are filtered out
only-files	BOOLEAN	-only-files	Generate files only, file names are appended to given domains
domain-file	FILE	-df	Input domain file, one domain per line

example

Run mkpath

mkpath · command

# mkpath: build paths from a wordlist for fuzzingmkpath -w paths.txt -l -only-dirs > url-paths.txt

sample output

/admin/api/api/v1/backup/dashboard/login/static/uploads

guidance

Choosing mkpath

Reach for mkpath when you want to shape a path list before fuzzing, not run the fuzz itself. It generates candidate paths; ffuf or feroxbuster send the requests. For subdomain candidates instead, use mksub.

mksub

Sibling generator for subdomains instead of URL paths. Same wordlist-permutation idea at the DNS layer.

ffuf

Sends the requests. mkpath builds the path list that ffuf consumes; they pair rather than compete.

feroxbuster

Recursive content discovery. Feed it mkpath output to start from a target-shaped list.

faq

mkpath questions

No. It only generates URL paths from a wordlist and writes them to a file. Pass that file to a fuzzer such as ffuf or feroxbuster to probe the target.

Run mkpath yourself

A wordlist feeds mkpath, which builds candidate URL paths and hands them to ffuf for content discovery before the hits land as a queryable output.

Open mkpath in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.