Discover Paths via Directory Brute Force

Directory brute force finds the paths an application does not link, by guessing from a wordlist and keeping the responses that do not look like a miss. Hidden path discovery needs this pass because crawling only maps what is linked and OSINT only recovers what was archived; unlinked endpoints stay invisible without a wordlist. Feed it a list of live URLs and the module runs the same pass across thousands of servers in parallel, with heuristic filtering that drops masked 404s so a 200 is not automatically a real directory.

You pass a file of live web server URLs and the module guesses unlinked paths from a wordlist, then keeps the responses that do not look like a miss. Heuristic filtering drops masked 404s (custom error pages, SPA catch-alls, wildcard 200s) so a 200 is not automatically a real directory. The same pass runs across thousands of servers; it does not follow links and it does not query archives.