LULS / URL FUZZER / 1.0 ALPHA

Find the paths behind a URL.

URL Fuzzer substitutes a wordlist into an HTTP or HTTPS address and shows each response’s status, size, time and errors. It has native Windows, Linux and Android interfaces, editable wordlists, request controls and CSV/JSON export.

Windows x64 ↧Linux x64 ↧Android APK ↧

Download checksums · Licenses & notices

Windows

  1. Download the Windows ZIP and extract the entire folder.
  2. Keep URL-Fuzzer.jar, the runtime folder and Start-URL-Fuzzer.cmd together.
  3. Double-click Start-URL-Fuzzer.cmd from the extracted folder. Java is included; no separate Java installation is needed.

This package is for 64-bit Windows on x86-64 hardware. The Windows archive and vendor runtime checksum were checked; Windows execution has not been tested in this build environment.

Linux

  1. Extract the Linux archive and open the URL-Fuzzer-Linux-x64 folder.
  2. Run ./Start-URL-Fuzzer from a terminal, or open the launcher using your desktop’s normal executable-file workflow.
  3. Keep the included runtime folder beside the JAR and launcher.
tar -xzf URL-Fuzzer-Linux-x64-1.0-alpha.tar.gz
cd URL-Fuzzer-Linux-x64
./Start-URL-Fuzzer

A graphical x86-64 Linux desktop and its normal graphics/font libraries are required. Java is included. If an extraction tool removes the launcher’s executable bit, run chmod +x Start-URL-Fuzzer. ./Start-URL-Fuzzer --self-test performs a small offline runtime check.

Android

  1. Open URL-Fuzzer-1.0-alpha.apk on Android 8 or newer. Allow installation from the app opening the APK if Android asks.
  2. On Setup, enter the target and edit the starter words, tap Import .txt to choose a UTF-8 wordlist, or tap Get SecLists.
  3. Set request options and tap Start. The Results screen shows progress and response rows. Tap a row for details or to copy its URL.
  4. Choose Export JSON or Export CSV, then pick a destination in Android’s save dialog. Import/export uses Android’s document picker and needs no broad storage permission.

Rotation keeps the current activity in place. Scans live in the app process; keep the app open for long runs. Android may suspend or terminate background work, and a scan does not resume after process death. Results are not automatically saved: export them before closing.

Run a scan

  1. Use FUZZ in the URL’s path or query, such as https://example.com/FUZZ or https://example.com/search?q=FUZZ.
  2. Load or edit one word per line. Blank lines and duplicate entries are removed. The optional SecLists button downloads Discovery/Web-Content/common.txt from its GitHub repository only when tapped.
  3. Choose GET or HEAD. Set workers, requests per second and timeout. Optional headers use one Name: value line each; Android also has a dedicated Cookie field. On desktop, enter Cookie: name=value in the headers box.
  4. Set status and body-size match filters if needed, then start. Pause blocks new requests while requests already in flight may finish. Resume continues; Stop cancels outstanding work.

The enabled Keep / separators option supports nested path entries such as admin/login. Turn it off to encode the word as a single path component. Query substitutions always encode slashes and delimiters. Other word characters are UTF-8 percent-encoded.

Defaults and limits

SettingDefault / limit
MethodGET; HEAD is also available.
Concurrency4 workers by default; 1–32 allowed.
Request rate5 requests/second by default; 0.1–1,000 allowed. This rate is shared across workers and redirect hops.
Timeout10 seconds by default. Android: 0.1–120 seconds; desktop: 1–120 seconds.
RedirectsNot followed by default; response status and Location stay visible. Optional following allows up to five hops within the original scheme, host and port.
Wordlist sizeUp to 16 MiB of UTF-8 data and 100,000 unique entries in the shared loader. Android permits 10,000 unique words per scan and 1 MiB of editable text; larger imports require a smaller list before scanning. Desktop permits up to 100,000 entries. Individual entries are limited to 8,192 characters.
Body reads4 MiB per response. Oversized responses are flagged. Bodies are discarded after measuring bytes and SHA-256. HEAD reads no body and reports zero body bytes.
Saved sessionsNo scan restoration or automatic result saving. Export a snapshot as CSV or JSON.

Read and export results

Results include HTTP status, streamed body bytes, elapsed milliseconds, URL, word, redirect information and any error. Response details include a SHA-256 digest of the bytes read. A truncated body’s digest covers only its retained prefix.

Status/size filters mark matches without deleting collected results. Leave status blank to include all statuses. Desktop accepts individual codes separated by commas or spaces, such as 200,204,301; Android also accepts ranges such as 200-299. Use Show matches only to narrow the view and export. Desktop additionally supports table sorting and text search; the text-search field does not change what an export contains.

CSV and JSON exports contain response summaries, not full bodies or request headers/cookies. Target URLs, including query values you entered, remain in results and exports. Scans contact the chosen target directly; there is no LULS scanning service, account or analytics backend.

Build validation

The shared engine passed 93 loopback checks; the native Android form passed 41 validation assertions. Linux runtime startup and 11 real Swing UI checks passed in the build workspace. These checks used local fixtures rather than scans of public sites.

Physical Android UI/document providers/background behavior and Windows runtime execution have not been tested here. This is an alpha release. Large scans and exports use additional memory.

Component licenses, runtime provenance & notices · Back to Apps ↙