Menú
Discover hidden directories, files, and endpoints on a web server
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
| name | directory-fuzzing |
| description | Discover hidden directories, files, and endpoints on a web server |
| origin | RedteamOpencode |
run_tool ffuf (primary), run_tool gobuster (fallback), run_tool curl (verification)
run_tool curl -s -o /dev/null -w "Code: %{http_code}, Size: %{size_download}" https://TARGET/nonexistent12345
run_tool ffuf -u https://TARGET/FUZZ -w /usr/share/wordlists/dirb/common.txt -fc 404
run_tool ffuf -u https://TARGET/FUZZ -w /usr/share/wordlists/dirb/common.txt -ac # Auto-calibrate
run_tool gobuster dir -u https://TARGET -w /usr/share/wordlists/dirb/common.txt -t 50 # Fallback
run_tool ffuf -u https://TARGET/FUZZ -w /usr/share/wordlists/dirb/common.txt \
-e .php,.html,.js,.txt,.bak,.old,.conf,.xml,.json,.yml,.env,.log,.sql,.zip,.tar.gz
# Tech-specific: PHP(.phps,.phtml,.inc) ASP(.aspx,.config) Java(.jsp,.do,.action)
-fc 404,403,301 # Status code filter
-fs 1234 # Response size filter
-fw 42 / -fl 10 # Word/line count filter
-mc 200,301,302,403 # Match only specific codes
run_tool ffuf -u https://TARGET/FUZZ -w /usr/share/wordlists/dirb/common.txt -ac -recursion -recursion-depth 2
run_tool ffuf -u https://TARGET/admin/FUZZ -w /usr/share/wordlists/dirb/common.txt -ac
# L1: /usr/share/wordlists/dirb/common.txt (~4,600)
# L2: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt (~20,000)
# L3: /usr/share/wordlists/dirbuster/directory-list-2.3-big.txt (~220,000)
# Specialized: /usr/share/seclists/Discovery/Web-Content/raft-medium-{directories,files}.txt
# API: /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt
run_tool ffuf -u https://TARGET/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt \
-e .bak,.old,.orig,.save,.swp,.tmp,~,.copy
for f in .env .git/config .htaccess web.config wp-config.php .DS_Store; do
code=$(run_tool curl -s -o /dev/null -w "%{http_code}" "https://TARGET/$f")
[ "$code" != "404" ] && echo "$f -> $code"
done
run_tool curl -s https://TARGET/.git/HEAD
run_tool curl -s https://TARGET/.svn/entries | head -5
run_tool ffuf -u https://TARGET -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
-H "Host: FUZZ.TARGET" -ac
run_tool ffuf -u https://TARGET/FUZZ -w wordlist.txt -ac -o $DIR/scans/dir_fuzz_results.json -of json
run_tool curl -sI https://TARGET/discovered_path # Verify
Business logic vulnerability detection — workflow bypass, price manipulation, state abuse, and application-specific flaws
Detect PII, credentials, and corporate sensitive data in API responses, source code, files, headers, and database extracts
Detect and exploit SQL injection vulnerabilities in web application parameters
Test for authentication and authorization flaws including credential attacks, session issues, and access control bypasses
Detect and exploit cross-site scripting vulnerabilities in web applications
Discover hidden parameters, test values, and identify input handling anomalies