Directory Brute Force with Gobuster
Once we have discovered an application running on a web server,
our next step is to map all its publicly-accessible files and directories.
To do this, we would need to perform multiple queries
against the target to discover any hidden paths.
Gobuster is a tool that can help us with this sort of enumeration.
It uses wordlists to discover directories
and files on a server through brute forcing.
Gobuster supports different enumeration modes,
including fuzzing and dns,
but for now, we’ll only rely on the dir mode,
which enumerates files and directories.
We need to specify the target IP using the -u parameter
and a wordlist with -w.
The default running threads are 10;
we can reduce the amount of traffic
by setting a lower number via the -t parameter.
Our scan found ten resources.
Four of these resources are inaccessible due to insufficient privileges.
However, the remaining six are accessible and deserve further investigation.