Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What is it called when a user tries several attempts to figure out the files and folder structure on a web server?

For example, the attacker will run to determine if test.jpg exists or not before commencing on other kind of attacks?

share|improve this question

The proper term for it is Forced (or Forceful) Browsing.

share|improve this answer

w3af calls this URL Fuzzing. Nikto also does this to some degree by looking for common files and directories such as /phpmyadmin and /info.php.

share|improve this answer
Yep that's the term. Thanks! – mauris Mar 29 '11 at 17:21
That's not really so common... – AviD Mar 29 '11 at 22:56
Fuzzing is usually used to refer to trying a range of likely inputs as parameters in the URL or input fields, whereas the topic in the question is forceful browsing, as AviD described. – Rory Alsop Mar 29 '11 at 23:19
-1 for inaccuracy. AviD's answer is correct. – Josh Brower Apr 1 '11 at 2:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.