Home

Not every page is in the menu. What did the developers forget to remove from the webroot before shipping? The nav shows what RatVault wants you to see — your job is to map what it does not. Start with the Recon Playbook below.

Recon Playbook — Content Discovery

This panel teaches the technique. It intentionally does not list this lab’s hidden paths — discovering them is the exercise. Route everything through Burp and filter by status/size to cut soft-404 noise.

What is content discovery?

Finding files and directories the app never links to: leftover .bak/.old/~ backups, .zip/.tar.gz archives, editor swap files (.swp, .DS_Store), an exposed .git directory, robots.txt, sitemap.xml, /.well-known/, directory listings, and forgotten dev/admin/staging endpoints. Every extra path is attack surface the developers forgot to remove.

Quick manual wins

# always read these first
curl -s https://cwap.thexssrat.com/discovery/robots.txt
curl -s https://cwap.thexssrat.com/discovery/sitemap.xml
curl -s https://cwap.thexssrat.com/discovery/.well-known/security.txt

# exposed source control? try it, then dump it
curl -s https://cwap.thexssrat.com/discovery/.git/HEAD
curl -s https://cwap.thexssrat.com/discovery/.git/config
git-dumper https://cwap.thexssrat.com/discovery/.git/ ./loot

# for any filename you already know, try backup suffixes
#   config.php -> config.php.bak / config.php.old / config.php~
#   index.php  -> .index.php.swp
for s in .bak .old .zip .txt .swp '~'; do \
  curl -s -o /dev/null -w "%{http_code} config.php$s\n" \
  https://cwap.thexssrat.com/discovery/config.php$s; done

SecLists wordlists

/usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
/usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt
/usr/share/seclists/Discovery/Web-Content/raft-large.txt
/usr/share/seclists/Discovery/Web-Content/common.txt
/usr/share/seclists/Discovery/Web-Content/big.txt

ffuf — recursive + extension fuzzing

Note the /discovery/ path prefix in the target URL — FUZZ goes after it.

# directories, recurse two levels deep
ffuf -u https://cwap.thexssrat.com/discovery/FUZZ \
  -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
  -recursion -recursion-depth 2 -e .bak,.old,.zip,.txt,.php,.swp -fc 404

# files, keep redirects/forbidden (often real)
ffuf -u https://cwap.thexssrat.com/discovery/FUZZ \
  -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt \
  -e .bak,.old,.zip -mc 200,301,302,403

feroxbuster — recursive with link extraction

feroxbuster -u https://cwap.thexssrat.com/discovery/ \
  -w /usr/share/seclists/Discovery/Web-Content/raft-medium.txt \
  -x bak,old,zip,txt,swp -d 3 --extract-links

dirsearch — alternative

dirsearch -u https://cwap.thexssrat.com/discovery/ \
  -w /usr/share/seclists/Discovery/Web-Content/raft-large.txt \
  -e bak,old,zip,txt -r

Chain what you find

Discovery is iterative: a path found inside one artifact (a leaked .git/config, a downloaded backup archive, an HTML comment, a sitemap entry) points at the next hidden thing. Read everything you pull, then feed the new names back into your wordlists. When a scanner stalls, switch to --extract-links / recursion so newly found directories get fuzzed too.

Welcome to RatVault