dirb

URL / directory brute-forcer. Authorized testing only.

$ dirb http://target/ /usr/share/wordlists/dirb/common.txt
$ dirb http://target/ -X .php,.bak