skills.rest
crazyMarky
crazyMarkyCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

recon-dir-scan

Enumerate web application directories and files using ffuf, gobuster, and feroxbuster.

277|29|Updated Feb 6, 2026
Search Tags:#ffuf#reconnaissance#web fuzzing#file discovery#directory scanning#api enumeration#gobuster
One-click install
npx skills add https://github.com/crazyMarky/pentest-skills --skill recon-dir-scan
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: recon-dir-scan
Source: https://github.com/crazyMarky/pentest-skills/tree/main/recon-dir-scan
Command: npx skills add https://github.com/crazyMarky/pentest-skills --skill recon-dir-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

This Skill helps you uncover hidden directories, files, and API endpoints on web applications that are not directly linked, improving your attack surface visibility.

Core Features & Use Cases

  • Directory Enumeration: Fuzz web servers to find common and uncommon directories.
  • File Discovery: Locate backup files, configuration files, and sensitive documents.
  • API Endpoint Discovery: Identify potential API endpoints for further testing.
  • Use Case: When assessing a web application, use this Skill to find hidden administrative panels, backup archives, or unlinked API routes that could contain vulnerabilities.

Quick Start

Scan the target URL 'https://example.com' for directories using the common wordlist.

Frequently Asked Questions about recon-dir-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover hidden directories and files on a web application?▼

Directory and file enumeration uncovers hidden web paths not directly linked by fuzzing web servers using tools like ffuf and gobuster to identify administrative panels, backup files, and configuration files.

Can I find unlinked API endpoints through path fuzzing?▼

API endpoint discovery through path fuzzing identifies potential API routes on web applications, improving attack surface visibility by locating unlinked endpoints for further security testing.

What tools do I need to perform directory scanning and file discovery?▼

Directory scanning requires ffuf and gobuster to be installed for core functionality, while feroxbuster is also utilized to perform comprehensive path enumeration and locate sensitive documents.

What is the best way to locate backup files and configuration files on a web server?▼

File discovery locates backup archives, configuration files, and sensitive documents by fuzzing web servers with wordlists to find common and uncommon files hidden on the target application.

Does directory enumeration work for finding hidden administrative panels?▼

Directory enumeration finds hidden administrative panels by fuzzing the target URL with wordlists to map out the web application's attack surface and expose unlinked directories.

When should I use web fuzzing for reconnaissance?▼

Use web fuzzing during web application assessments to find hidden administrative panels, backup archives, or unlinked API routes that could contain vulnerabilities and require further testing.

Related Skills

Explore More Software Engineering Skills→
zebbernzebbern
34

Quick Pentest Reference

Provides rapid-fire command references for penetration testing tasks like enumeration and brute-forcing.

Community
Intermediate
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

security-entry-point-analyzer

Map and analyze application entry points to assess security risk.

Official
Intermediate
transilienceaitransilienceai
462

domain-assessment

Coordinate subdomain discovery and port scanning to build a domain attack surface inventory.

Official
Basic
AeonDaveAeonDave
15

ffuf

Fuzz HTTP endpoints with wordlists to discover directories, parameters, and virtual hosts.

Community
Intermediate