loading
Loading content
loading
Utilities
Make URL paths from a wordlist to seed content discovery.
overview
mkpath generates URL paths from wordlists so fuzzers and crawlers receive a ready-made path set instead of ad hoc string concatenation.
Options for lowercasing, recursion depth, and dirs-versus-files keep the generated set aligned with how the target names content.
Use it ahead of ffuf, feroxbuster, or similar when you want a normalized path list from one or more wordlists.
source github.com/trickest/mkpath
use cases
Generate a path list from a curated wordlist, then hand it to ffuf or feroxbuster so the fuzzing run hits paths tuned to the target rather than a generic dictionary.
Raise the level flag to produce multi-segment paths so directory brute forcing reaches nested routes that a single-segment list would never test.
Use only-dirs or only-files to separate folder probing from filename guessing, keeping each fuzzing pass focused and faster to triage.
Apply a regex and lowercasing to strip unwanted entries and collapse duplicates before the paths ever reach a fuzzer.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| level | STRING | -l | Path depth to generate (default 1) |
| lower | BOOLEAN | -lower | Convert wordlist file content to lowercase |
| regex | STRING | -r | Regex to filter words from wordlist file |
| domain | STRING | -d | Input domain |
| wordlist | FILE | -w | Wordlist file |
| only-dirs | BOOLEAN | -only-dirs | Generate directories only, files are filtered out |
| only-files | BOOLEAN | -only-files | Generate files only, file names are appended to given domains |
Showing key inputs. mkpath exposes 8 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| level | STRING | -l | Path depth to generate (default 1) |
| lower | BOOLEAN | -lower | Convert wordlist file content to lowercase |
| regex | STRING | -r | Regex to filter words from wordlist file |
| domain | STRING | -d | Input domain |
| wordlist | FILE | -w | Wordlist file |
| only-dirs | BOOLEAN | -only-dirs | Generate directories only, files are filtered out |
| only-files | BOOLEAN | -only-files | Generate files only, file names are appended to given domains |
| domain-file | FILE | -df | Input domain file, one domain per line |
example
# mkpath: build paths from a wordlist for fuzzingmkpath -w paths.txt -l -only-dirs > url-paths.txt/admin/api/api/v1/backup/dashboard/login/static/uploadsguidance
Reach for mkpath when you want to shape a path list before fuzzing, not run the fuzz itself. It generates candidate paths; ffuf or feroxbuster send the requests. Use it to nest paths and filter a wordlist so the fuzzing stage starts from a tailored list.
Sibling generator for subdomains instead of URL paths. Same wordlist-permutation idea, applied to the DNS layer.
Sends the requests. mkpath builds the path list that ffuf consumes; they pair rather than compete.
Recursive content discovery. Feed it mkpath output to start from a target-shaped list.
faq
related
Import, export, and link workflow data with Airtable.
Decode Android APK files into smali sources and resources.
Check a file's values against conditions and exit with a matching code.
Extract all hosted zones from AWS Route53.
Output file lines by batch size, given START_LINE and END_LINE.
Extract a batch range from a file's lines or a folder's files, with parallel processing.
A wordlist feeds mkpath, which builds candidate URL paths and hands them to ffuf for content discovery before the hits land as a queryable output.
Facts on this page come from the live Trickest tool library.