Content Discovery
Discover Paths via Directory Brute Force
Brute-force web server URLs to find hidden paths. Heuristics drop masked 404s. Built-in or custom wordlist. Thousands of servers in parallel.
What Discover Paths via Directory Brute Force does
Directory brute force finds the paths an application does not link, by guessing from a wordlist and keeping the responses that do not look like a miss. Hidden path discovery needs this pass because crawling only maps what is linked and OSINT only recovers what was archived; unlinked endpoints stay invisible without a wordlist. Feed it a list of live URLs and the module runs the same pass across thousands of servers in parallel, with heuristic filtering that drops masked 404s so a 200 is not automatically a real directory.
You pass a file of live web server URLs and the module guesses unlinked paths from a wordlist, then keeps the responses that do not look like a miss. Heuristic filtering drops masked 404s (custom error pages, SPA catch-alls, wildcard 200s) so a 200 is not automatically a real directory. The same pass runs across thousands of servers; it does not follow links and it does not query archives.
Where it fits in the pipeline
Pipeline guidance
Upstream: Probe for Web Servers, or any inventory that already emits live URLs. Nest after liveness.
Downstream: Kept urls feed Scan for Sensitive Files, Scan for Exposed Backups, Scan for Exposed Admin Panels, and Fuzz Web Applications for Vulnerabilities. Those classify or attack the path list. This module only produces it.
Parallel: Discover Paths via Crawling and Discover Paths via OSINT Sources. Same urls / url-details shape, different data_source. Run them beside this, not instead of it.
When to use this
Nest this after you have live web server URLs. It is a content step on a typed FILE face: you drop the subgraph into a workflow; you do not run it from a shell. Dead or unprobed hosts produce nothing. It does not produce hostnames. A URL list from probe is the usual seed; a static inventory of live URLs works too.
Data
The tables this module produces. Sample rows are illustrative.
Kept path list: unlinked paths guessed from the wordlist, masked 404s dropped.
urlurl | |
|---|---|
| 1 | https://example.com/admin |
| 2 | https://example.com/.git/config |
| 3 | https://example.com/backup.zip |
JSONLines per kept URL with response metadata.
urlurl | methodtext | status_codeint | titletext | content_lengthint | hostnametext | |
|---|---|---|---|---|---|---|
| 1 | https://example.com/admin | GET | 200 | Admin Panel | 5120 | example.com |
| 2 | https://example.com/.git/config | GET | 200 | 92 | example.com | |
| 3 | https://example.com/backup.zip | GET | 200 | 1048576 | example.com |
How it differs from similar modules
Discover Paths via Directory Brute Force
Artifact class it owns
Unlinked paths from a wordlist; masked 404s dropped
Upstream it needs
Live web server URLs
Artifact class it owns
Linked paths, including JavaScript the crawl can see
Upstream it needs
Live web server URLs
Artifact class it owns
Third-party and archived URLs for those hosts
Upstream it needs
Hostnames
questions
Discover Paths via Directory Brute Force questions
Nest Discover Paths via Directory Brute Force in a workflow
Drop this module into a Trickest workflow and connect it to your upstream and downstream nodes. The face contract above is the wiring.
Get a personalized demo
See Trickest in Action
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.