Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

What is it called when a user tries several attempts to figure out the files and folder structure on a web server?

For example, the attacker will run http://example.com/test.jpg to determine if test.jpg exists or not before commencing on other kind of attacks?

share|improve this question

3 Answers

up vote 4 down vote

The proper term for it is Forced (or Forceful) Browsing.

share|improve this answer
up vote 2 down vote

w3af calls this URL Fuzzing. Nikto also does this to some degree by looking for common files and directories such as /phpmyadmin and /info.php.

share|improve this answer
Yep that's the term. Thanks! – mauris Mar 29 '11 at 17:21
That's not really so common... – AviD♦ Mar 29 '11 at 22:56
3  
Fuzzing is usually used to refer to trying a range of likely inputs as parameters in the URL or input fields, whereas the topic in the question is forceful browsing, as AviD described. – Rory Alsop♦ Mar 29 '11 at 23:19
1  
-1 for inaccuracy. AviD's answer is correct. – Josh Brower Apr 1 '11 at 2:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.