Directory and path scanner
Probe a target for common paths and hidden files with adjustable concurrency, reporting status, type, and timing for each hit.
Open in ctfpalContent discovery is the highest-yield first move on a web challenge, because the interesting endpoint is rarely linked from the page you were given. A wordlist of common paths finds admin panels, backups, and configuration files that the application never advertises.
Read the whole response, not just the status
- 200 - it exists. Obviously interesting.
- 403 - it exists and you are not allowed in. Often more interesting than a 200, because it confirms the path is real.
- 301/302 - where it redirects to is itself a discovery.
- A 404 with an unusual length - some applications return 404 for everything; the response size then distinguishes real paths from fake ones. Same for timing.
The paths that pay off
.git/, .env, backup.zip, robots.txt, .DS_Store, admin/, api/, swagger.json, and editor leftovers like index.php~ or config.php.bak. robots.txt deserves special mention: it is a list of paths the owner did not want indexed, which is a curated list of things worth looking at.
Part of a module
6. Web attacks and session tokens
Read and forge JWTs and Flask sessions, find content nobody linked to, and probe for injection with detection payloads.
Practise on real challenges
Related tools
Exposed .git directory dumper
Reconstruct a repository from an exposed .git directory - recovering source, deleted files, and secrets from the commit history.
HTTP request replayer
Craft and replay HTTP requests with arbitrary methods, headers, and bodies, and read the raw response - a Repeater that runs in your browser.
HTTP security header analyzer
Analyse CSP, HSTS, X-Frame-Options, and CORS headers on a response - and find the gaps in a Content-Security-Policy that make XSS exploitable.
Reverse shell generator
Generate reverse shell one-liners for bash, nc, Python, Perl, Ruby, PHP, Node, and PowerShell, plus listeners and TTY stabilisation commands.