You can use DirBuster, it's a program that brute forces URLs starting from a base you decide and following rules you set yourself. This way it can find hidden or unindexed web pages in every website and give you all the results it finds, you can also tell it to use a dictionary file instead to look for a list of words as URLs instead of launching a brute force. I find myself using it very often, it may not be too new but it still does its job.
Bear in mind that if you find a page it doesn't always mean you can access it, for example you may find a 403 HTTP error, it means you are unauthorized to access that resource, but it also means it exists. This is pretty much the only way unless that website is vulnerable to a vulnerability called directory traversal, which allows you to navigate through the directories of the server, or even again another vulnerability called arbitrary code execution, local file inclusion, etc... in short, the one way above is the most likely to have success. Good luck.