I am trying to figure out how OWASP ZAP discovered a directory on a practice vm, I entered the host IP and hit attack, and the spider discovered this directory (pChart2.3.1).
I have searched every wordlist used by dirbuster and none of them contain this string so dirbuster would not find it. I also tried using spider in Burp, but it came up blank. (The index page simply says "It Works" with nothing additional in the source.) ZAP seems to have sent a request for robots.txt, then for sitemap.xml, and then struck the directory. The thing is, neither robots.txt or sitemap.xml exist.
My question in a nutshell is, does OWASP ZAP use a specific wordlist to search for directories, and if so, where is it. Alternatively, has it managed to get sitemap.xml even though the server says it doesn't exist?
I am taking a practical exam soon that doesn't allow the use of ZAP, and would like to be able to replicate its findings in another tool, or even just understand what it has done!