Automate directory brute-forcing and fingerprinting of web targets with spray.
npx skills add https://github.com/wgpsec/AboutSecurity --skill spray-dir-brute
Please help me install this Agent Skill. Skill: spray-dir-brute Source: https://github.com/wgpsec/AboutSecurity/tree/main/skills/tool/spray-dir-brute Command: npx skills add https://github.com/wgpsec/AboutSecurity --skill spray-dir-brute
Automates high-volume discovery of web directories, backup files, and fingerprints to accelerate web security testing and vulnerability discovery, reducing manual enumeration time.
Execute spray against the target using a wordlist to enumerate directories and detect backup files.
High-intent search queries and answers about installing and using this skill.
You can automate directory brute-forcing for multiple web applications by executing spray via command-line with dictionaries, targeting single or multiple URLs to discover accessible directories and backup files.
The best way to discover backup files during a web pentest is to use spray's high-performance directory brute-forcing with smart filtering, which accelerates enumeration and ignores invalid responses to reveal hidden paths.
Smart filtering in web directory scanning works by automatically ignoring invalid HTTP responses during high-volume brute-forcing, ensuring the results returned for directories and backup files are accurate and actionable.
Yes, you can identify CMS and frameworks while brute-forcing directories by applying spray's integrated fingerprinting mode, which uses multiple libraries to detect technologies alongside path enumeration.
Yes, you need wordlists to perform directory enumeration with spray, as it requires command-line usage of dictionaries alongside optional flags for suffixes, smart filtering, and fingerprinting modes.
Limitations of using spray include its reliance on the quality of provided wordlists and potential performance impacts when scanning multiple high-volume web targets without properly configuring smart filtering.
wgpsecLocate local pentest wordlists and resolve absolute paths for ffuf and spray.
yhy0Enumerate web attack surfaces with curl, dirsearch, gobuster, ffuf, nmap, and whatweb.
jcastillotxGuide security scanning tool selection, configuration, and multi-domain assessment workflows.
AeonDaveScan web servers for hidden directories and files with recursive scanning.
