Module 06 · Dir & File Enumeration¶

Flag: --skip-dirbrute

Combines wordlist-based directory brute-forcing with targeted probing of 40+ known sensitive paths.

Directory brute-force¶

Tool priority: gobuster → ffuf → dirb

# Use a custom wordlist
./websec-audit.sh -t https://target.com --wl-dirs-small /path/to/custom.txt

Sensitive path probing¶

40+ paths are probed directly with curl regardless of the brute-force wordlist. Findings are severity-classified automatically:

Output files¶

dirs/
├── gobuster_dirs.txt
├── gobuster_dns.txt
├── ffuf_results.json
├── dirb_results.txt
└── sensitive_paths_found.txt   # only paths that returned 200/301/302