Directory & Content Discovery
Web servers host paths that are never linked from the homepage: /admin, /backup, /.git, /api, old config files. Content discovery (or 'dirbusting') brute-forces these with a wordlist, each hidden path is more attack surface, and the exposed ones are classic easy wins.
Read the status codes
Every guess returns an HTTP status. Learn to read them:
| Code | Meaning |
|---|---|
| 200 | Exists and readable |
| 301/302 | Redirect , usually a real directory |
| 403 | Forbidden , it exists, you just can't read it (very interesting) |
| 401 | Needs authentication |
| 404 | Not found , ignore |
A 403 is not a dead end: the path is there. Never discard non-200 results.
gobuster , fast and simple
gobuster dir -u http://10.10.10.20 \
-w /usr/share/seclists/Discovery/Web-Content/common.txt \
-x php,txt,html # also try these file extensions
dir mode = content discovery (the same tool does dns mode for subdomains).
ffuf , the flexible fuzzer
ffuf replaces the keyword FUZZ with each word from the list. Put FUZZ wherever you want to fuzz , path, parameter, header, or vhost.
ffuf -u http://10.10.10.20/FUZZ -w common.txt -mc 200,301,403
ffuf -u http://10.10.10.20/FUZZ -w common.txt -fs 279 # filter out the 279-byte 404 page
Key filters: -mc match codes, -fc filter codes, -fs filter by response size (to kill a soft-404 that returns 200 for everything).
Alternatives
- feroxbuster , Rust, fast, recurses automatically into directories it finds.
- dirb / dirsearch , classic, simple.
- wfuzz , the flexible ancestor of ffuf.
Wordlists to use
From SecLists Discovery/Web-Content/: common.txt (quick), raft-* lists, and directory-list-2.3-medium.txt (thorough). Bigger list = more found, but slower and noisier.
Try it (terminal)
gobuster dir -u http://10.10.10.20 -w /usr/share/seclists/Discovery/Web-Content/common.txt.ffuf -u http://10.10.10.20/FUZZ -w common.txt, same idea, FUZZ marks the spot.- Note the finds:
/admin(301),/login(200),/backup(403),/.git(301).
Why this matters
An exposed /.git leaks source code, a /backup folder leaks a database dump, and a hidden /admin is a login to attack. Content discovery is where a plain website turns into a target.