generate urls for bruteforce