Content Discovery & Directory Fuzzing Done Right

Content discovery — aka directory fuzzing, aka "brute-forcing paths" — is how you find the pages, files, and endpoints that aren't linked ANYWHERE. Admin panels, backups, hidden APIs, forgotten test pages. Let me show you how to do it RIGHT (because most people do it badly).

What It Is

Websites have tons of paths that aren't linked from the visible pages: /admin, /backup.zip, /api/v1/internal, /.git/, /test.php, /config. Content discovery is throwing a big list of likely path names at the server and seeing which ones actually exist (return something interesting instead of a 404).

It's basically knocking on thousands of doors quickly to find the unlocked, unlisted ones.

The Tools

• ffuf — fast, flexible, my go-to fuzzer
• feroxbuster — great for recursive discovery (finds dirs, then fuzzes inside them automatically)
• gobuster — classic and simple
• dirsearch — beginner-friendly with good defaults

Basic ffuf looks like:

ffuf -w wordlist.txt -u <https://target.com/FUZZ>

ffuf -w wordlist.txt -u <https://target.com/FUZZ>

The FUZZ keyword is where each word from your list gets swapped in.

Doing It RIGHT (Where Most People Fail)

1. Your wordlist is everything. A bad wordlist finds nothing; a great one finds gold. Use quality lists — SecLists is the gold standard (raft lists, common.txt, API-specific lists). Match the list to the target (API wordlist for APIs, backup-file list when hunting backups).

2. Filter the noise. Servers return status codes. Don't just look at 200s. Filter OUT the boring (mass 404s) and pay attention to interesting ones: 200 (exists), 403 (exists but forbidden — often juicy!), 401 (needs auth), 500 (error — something's there), 301/302 (redirects worth following). A 403 means "this exists but you can't have it" — which is exactly what you want to poke at.

3. Fuzz by extension. Hunting backups? Fuzz FUZZ.zip, FUZZ.bak, FUZZ.old, FUZZ.sql. Hunting code? FUZZ.php, FUZZ.js.

4. Recurse. Found /admin/? Fuzz INSIDE it. Found /api/? Fuzz inside that. The good stuff is often nested.

5. Respect the target. Rate-limit yourself (-rate in ffuf). Hammering a server is rude and can get you blocked or cause issues. Stay in scope.

What You're Hoping To Find

• Admin/dashboard panels (/admin, /dashboard, /manage)
• Backup files (/backup.zip, /db.sql, /site.tar.gz)
• Exposed version control (/.git/, /.svn/)
• Config/env files (/.env, /config.json)
• Hidden API endpoints (/api/internal, /api/v1/admin)
• Debug/test pages left in production