You have a target URL. You want to find hidden pages.

SecLists is a massive collection of multiple types of lists used during security assessments. It was originally created by Daniel Miessler and is now maintained by the community under the OWASP (Open Web Application Security Project) umbrella.

ffuf -u https://FUZZ.example.com -w SecLists/Discovery/DNS/subdomains-top1million-5000.txt