Background: as a pentester I often just get IP addresses where websites are hosted. Since sometimes DNS is not available or the client wants a black box test, getting to the actual hosted application is difficult. One technique commonly used is Web directory brute forcing. Tools like dirb, dirbuster and so on use wordlists. But these lists rarely get updated and often fail me in corporate environments (think share point, owa, Lync/sfb...).

What efficient ways and techniques are there to create these lists beforehand? What ways are there to get e.g. a tomcat/iis/... server to spill it's secrets without wordlists when tools like DNS are not available?

  • Don't know if you're aware of github.com/danielmiessler/SecLists but I've found the lists there are a lot better than the stock ones with most tools... – Matthew Feb 17 '17 at 10:51
  • Of course :) but often enough they don't suffice – simplex123 Feb 17 '17 at 11:06
  • If you run a threaded scanner and have permission, when in doubt, use bruteforce. It has helped me a few times. Dump folders often have names like 'tmp', 'TEMP', or 'asdf'... all pretty short. Wouldn't try it for paths above 5 bytes long though. Not very covert, obviously. – user400344 Feb 17 '17 at 13:38

You can use word lists in the Kali Linux /usr/share/wordlists. If you want to create specific word lists, you can use the Crunch.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.