https://www.rchitect.in/tags/wfuzz/Recent content in Wfuzz on rchitectHugoenTue, 29 Mar 2022 00:00:00 +0000https://www.rchitect.in/posts/directoryscan/Tue, 29 Mar 2022 00:00:00 +0000https://www.rchitect.in/posts/directoryscan/<h1 id="directory-scanning-to-identify-the-sub-domains"> Directory Scanning to identify the sub domains <a class="heading-link" href="#directory-scanning-to-identify-the-sub-domains"> <i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"></i> <span class="sr-only">Link to heading</span> </a> </h1> <p>Using the gobuster fing the sub directories</p> <pre tabindex="0"><code>gobuster dir -u http://10.10.10.88 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt =============================================================== Gobuster v3.1.0 by OJ Reeves (@TheColonial) &amp; Christian Mehlmauer (@firefart) =============================================================== [+] Url: http://10.10.10.88 [+] Method: GET [+] Threads: 10 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.1.0 [+] Timeout: 10s =============================================================== 2022/03/23 20:44:04 Starting gobuster in directory enumeration mode =============================================================== /webservices (Status: 301) [Size: 316] [--&gt; http://10.10.10.88/webservices/] /server-status (Status: 403) [Size: 299] =============================================================== 2022/03/23 21:01:06 Finished ===============================================================###### Login Credentials and Rabithole </code></pre><p>As we found one sub directory, always run one more gobuster scan with new subdirectory url to find if any more sub directories are present.</p>