Background: as a pentester I often just get IP addresses where websites are hosted. Since sometimes DNS is not available or the client wants a black box test, getting to the actual hosted application is difficult. One technique commonly used is Web directory brute forcing. Tools like dirb, dirbuster and so on use wordlists. But these lists rarely get updated and often fail me in corporate environments (think share point, owa, Lync/sfb...).
What efficient ways and techniques are there to create these lists beforehand? What ways are there to get e.g. a tomcat/iis/... server to spill it's secrets without wordlists when tools like DNS are not available?
