WebRuns locallyNo account
Directory and path scanner
Probe a target for common paths and hidden files with adjustable concurrency, reporting status, type, and timing for each hit.
Open in ctfpalContent discovery is the highest-yield first move on a web challenge, because the interesting endpoint is rarely linked from the page you were given. A wordlist of common paths finds admin panels, backups, and configuration files that the application never advertises.
Read the whole response, not just the status
- 200 - it exists. Obviously interesting.
- 403 - it exists and you are not allowed in. Often more interesting than a 200, because it confirms the path is real.
- 301/302 - where it redirects to is itself a discovery.
- A 404 with an unusual length - some applications return 404 for everything; the response size then distinguishes real paths from fake ones. Same for timing.
The paths that pay off
.git/, .env, backup.zip, robots.txt, .DS_Store, admin/, api/, swagger.json, and editor leftovers like index.php~ or config.php.bak. robots.txt deserves special mention: it is a list of paths the owner did not want indexed, which is a curated list of things worth looking at.