Free URL Fuzzer

Discover hidden files and directories on any website

Enter a URL to probe for commonly exposed files and directories. This tool checks for sensitive paths like .env files, .git directories, admin panels, backup files, and configuration endpoints that are frequently left accessible on production servers.

Trusted by teams at

Ramp
Pilot
Vercel
Stripe
Better Auth
SST
OpenCode

How it works

How URL Fuzzer works

01

Enter a base URL

Paste the root URL of any website. We'll use this as the base to probe for commonly exposed paths and files.

02

Probe common paths

We send HEAD requests to a curated list of sensitive paths — including environment files, version control directories, admin panels, backups, and configuration endpoints.

03

Review discovered paths

Get a report of which paths returned non-404 responses, their status codes, and an assessment of the security risk for each discovered resource.

Features

What URL Fuzzer checks

Sensitive file detection

Checks for .env, .htaccess, .DS_Store, and other files that should never be publicly accessible. These often contain credentials, API keys, and internal configuration.

Version control exposure check

Probes for exposed .git directories that can leak your entire source code repository, including commit history, credentials in old commits, and internal documentation.

Admin panel discovery

Checks common admin panel paths like /admin, /wp-admin, and /server-status that may be accessible without authentication or have weak access controls.

Backup and debug file scan

Looks for backup files (backup.zip), debug endpoints (/debug, /phpinfo.php), and log files that developers sometimes leave accessible on production servers.

API endpoint enumeration

Discovers common API paths including /api, /graphql, and /.well-known/security.txt that reveal application structure and may have different security controls than the main site.

Use cases

Who should use the free URL Fuzzer

Developers

Check your production deployment for accidentally exposed files. Catch .env files, .git directories, and debug endpoints before attackers find them.

Security Engineers

Run quick assessments of web servers during security reviews. Identify exposed configuration files, admin panels, and backup files across your infrastructure.

Penetration Testers

Use as a fast initial enumeration tool during engagements. Discover low-hanging fruit like exposed .git repos, .env files with credentials, and unprotected admin interfaces.

More tools

All free security tools

FAQ

Frequently asked questions

Everything you need to know about the free URL Fuzzer.

Go beyond URL Fuzzer

This free URL Fuzzer checks a handful of things. Maced's AI pentest checks thousands.

Get a full autonomous penetration test — including OWASP Top 10, authentication flaws, business logic errors, API security, and more — with a compliance-ready report in hours.

Proof of exploit on every finding · SOC 2 & ISO 27001 compatible