0X6C7879/recon-dir-scan
skills/recon-dir-scan/SKILL.md
Directory and file enumeration using ffuf, gobuster, dirsearch, and feroxbuster. Use this skill when user needs to discover hidden directories, enumerate files, find backup files, or map application structure through path fuzzing.
$ install --global
skillsauthnpx skillsauth add 0X6C7879/aegissec recon-dir-scanInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 22, 2026, 5:56 AM110.8s12 files scanned
SKILL.md
- name:
- recon-dir-scan
- description:
- Directory and file enumeration using ffuf, gobuster, dirsearch, and feroxbuster. Use this skill when user needs to discover hidden directories, enumerate files, find backup files, or map application structure through path fuzzing.
Directory and File Enumeration
Authorization Warning
IMPORTANT: Directory scanning without proper authorization may be detected as intrusion attempts. Always ensure you have:
- Written permission from the target application owner
- Defined scope of authorized testing
- Legal compliance with local regulations
Prerequisites
Required tools that must be installed on your system:
- ffuf -
go install github.com/ffuf/ffuf@latest - gobuster -
go install github.com/OJ/gobuster/v3/cmd/gobusterdir@main
Optional tools:
- feroxbuster -
cargo install feroxbuster - dirsearch -
pip install dirsearch - dirb - Package manager installation
Quick Start
Most commonly used commands for directory enumeration:
Fast Directory Scan (ffuf)
ffuf -w wordlist.txt -u https://target.com/FUZZ
Recursive Scan with Status Codes
ffuf -w wordlist.txt -u https://target.com/FUZZ -mc 200,301,302 -recursion
Gobuster Quick Scan
gobuster dir -u https://target.com -w wordlist.txt -t 50
Common Scenarios
Scenario 1: Basic Directory Fuzzing
When you need to discover directories and files:
ffuf -w wordlist.txt -u https://target.com/FUZZ
Parameters:
-w wordlist.txt- Wordlist path-u- Target URL with FUZZ keyword-t- Threads (default: 40)
Example:
ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt -u https://target.com/FUZZ
Scenario 2: Filter by Status Code
When you only want specific HTTP status codes:
ffuf -w wordlist.txt -u https://target.com/FUZZ -mc 200,301,302,403
Status Code Filters: | Code | Meaning | |------|---------| | 200 | OK (valid page) | | 301,302 | Redirects | | 403 | Forbidden (directory exists, no access) | | 401 | Authentication required |
Negation filter (exclude codes):
ffuf -w wordlist.txt -u https://target.com/FUZZ -mc 200,204,301,302,307,401,403 -mc 404
Scenario 3: Recursive Scanning
When you need to scan discovered directories recursively:
ffuf -w wordlist.txt -u https://target.com/FUZZ -recursion -recursion-depth 2
Parameters:
-recursion- Enable recursive scanning-recursion-depth- Maximum depth (default: 0)
Example:
ffuf -w wordlist.txt -u https://target.com/FUZZ -recursion -recursion-depth 3
Scenario 4: File Extension Fuzzing
When searching for specific file types:
ffuf -w wordlist.txt -u https://target.com/FUZZ -X .txt
Multiple extensions:
ffuf -w wordlist.txt -u https://target.com/FUZZ -X .txt,.php,.bak,.old
Extension from wordlist:
# Format: extension:wordlist
ffuf -w extensions.txt:EXT -w words.txt:FUZZ -u https://target.com/FUZZ.EXT
Scenario 5: Hidden File Discovery
When looking for backup, config, or hidden files:
# Hidden dotfiles
ffuf -w hidden_files.txt -u https://target.com/FUZZ
# Backup files
ffuf -w wordlist.txt -u https://target.com/FUZZ -X .bak,.backup,.old,.tmp,.swp
# Config files
ffuf -w config_files.txt -u https://target.com/FUZZ
Common hidden files to check:
.git
.env
.env.local
.env.backup
config.php.bak
wp-config.php.bak
.gitignore
.htaccess
Scenario 6: Virtual Host Discovery
When testing for virtual host routing:
ffuf -w vhosts.txt -u https://target.com -H "Host: FUZZ.target.com"
Parameters:
-H- Add custom headerFUZZin header value - Replaced by wordlist entries
Example:
ffuf -w subdomains.txt -u http://192.168.1.100 -H "Host: FUZZ.example.com"
Scenario 7: API Endpoint Discovery
When enumerating API endpoints:
ffuf -w api_endpoints.txt -u https://target.com/api/FUZZ
Common API patterns:
/api/v1/FUZZ
/api/v2/FUZZ
/graphql
/api/graphql
/rest/FUZZ
With HTTP methods:
ffuf -w endpoints.txt -u https://target.com/api/FUZZ -X GET,POST,PUT,DELETE
Scenario 8: Parameter Fuzzing
When discovering hidden parameters:
ffuf -w params.txt -u https://target.com/page?FUZZ=test
Value fuzzing:
ffuf -w values.txt -u https://target.com/page?param=FUZZ
Scenario 9: Gobuster Scanning
Alternative to ffuf using gobuster:
# Basic scan
gobuster dir -u https://target.com -w wordlist.txt -t 50
# With status filtering
gobuster dir -u https://target.com -w wordlist.txt -t 50 -k --status-codes 200,301,302,403
# Recursive
gobuster dir -u https://target.com -w wordlist.txt -t 50 -r
# With extensions
gobuster dir -u https://target.com -w wordlist.txt -t 50 -x php,txt,html
Scenario 10: Feroxbuster Scanning
Modern Rust-based directory scanner:
# Basic scan
feroxbuster -u https://target.com -w wordlist.txt
# With recursion and status codes
feroxbuster -u https://target.com -w wordlist.txt -C 404 --depth 3
# Scan multiple URLs
feroxbuster -u https://target.com -u https://target2.com -w wordlist.txt
Tool Selection Guide
| Scenario | Recommended Tool | Command |
|----------|------------------|---------|
| Quick scan | ffuf | ffuf -w wordlist.txt -u https://target.com/FUZZ |
| Recursive scan | ffuf | ffuf -w wordlist.txt -u https://target.com/FUZZ -recursion |
| Large wordlist | gobuster | gobuster dir -u https://target.com -w wordlist.txt -t 100 |
| Multi-target | feroxbuster | feroxbuster -u https://target.com -w wordlist.txt |
| Hidden files | ffuf | ffuf -w files.txt -u https://target.com/FUZZ |
| API discovery | ffuf | ffuf -w api.txt -u https://target.com/api/FUZZ |
Tool Comparison:
| Tool | Language | Speed | Features | Best For | |------|----------|-------|----------|----------| | ffuf | Go | Very Fast | Highly flexible, filtering | Most scenarios | | gobuster | Go | Fast | Simple, reliable | Quick scans | | feroxbuster | Rust | Fast | Multi-target, recursion | Large assessments | | dirsearch | Python | Medium | Built-in wordlists | Beginners |
Common Wordlists
| Wordlist | Size | Description | Location | |----------|------|-------------|----------| | common.txt | ~4,600 | Common dirs/files | SecLists | | raft-medium-directories | ~30,000 | Medium coverage | SecLists | | raft-large-directories | ~60,000 | Large coverage | SecLists | | directory-list-2.3-medium | ~220,000 | Comprehensive | DirBuster | | apache.txt | ~5,000 | Apache defaults | SecLists | | api-endpoints.txt | ~500 | API discovery | Custom |
SecLists paths:
/usr/share/seclists/Discovery/Web-Content/
/usr/share/seclists/Discovery/Web-Content/api/
/usr/share/seclists/Discovery/Web-Content/raft/
Advanced Techniques
Rate Limiting
Avoid detection by slowing requests:
ffuf -w wordlist.txt -u https://target.com/FUZZ -rate 100
User-Agent Rotation
ffuf -w wordlist.txt -u https://target.com/FUZZ \
-H "User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1)"
Authentication
# Basic auth
ffuf -w wordlist.txt -u https://user:[email protected]/FUZZ
# Header-based auth
ffuf -w wordlist.txt -u https://target.com/FUZZ \
-H "Authorization: Bearer TOKEN"
Cookie/Session Based
ffuf -w wordlist.txt -u https://target.com/FUZZ \
-H "Cookie: session=YOUR_SESSION_TOKEN"
Output Matching
Filter by response content:
ffuf -w wordlist.txt -u https://target.com/FUZZ \
-mr "admin" # Match response containing "admin"
ffuf -w wordlist.txt -u https://target.com/FUZZ \
-ms 1520 # Match specific response size
Output Formats
Save Results
# ffuf JSON output
ffuf -w wordlist.txt -u https://target.com/FUZZ -o results.json
# ffuf plain output
ffuf -w wordlist.txt -u https://target.com/FUZZ -o results.txt
# Gobuster output
gobuster dir -u https://target.com -w wordlist.txt -o results.txt
Resume Scanning
# ffuf resume
ffuf -w wordlist.txt -u https://target.com/FUZZ -resume-ffuf
Tips and Best Practices
- Start small - Use smaller wordlists first for quick wins
- Filter aggressively - Use
-mcto reduce noise - Check response sizes - Same size pages often indicate false positives
- Verify manually - Always check interesting results manually
- Rate limiting - Avoid blocking with appropriate delays
- Combine wordlists - Multiple wordlists for better coverage
- Check parameters - Don't forget to fuzz query parameters
- Look for 403s - Forbidden responses reveal valid paths
Resources
Scripts
scripts/ffuf_results_parser.py- Parse and filter ffuf JSON resultsscripts/merge_wordlists.py- Merge and deduplicate multiple wordlistsscripts/status_code_analyzer.py- Analyze response patterns
References
references/ffuf_guide.md- Comprehensive ffuf referencereferences/gobuster_guide.md- Gobuster usage documentationreferences/wordlist_guide.md- Wordlist selection and creation
Scenario: Persistent Storage of Directory Scan Findings
When you need to persist directory scan findings to the database:
# Manual entry after discovering directories
python .claude/skills/recon-dir-scan/scripts/dir_scan_storage.py \
--host-ip 192.168.1.100 \
--url "https://example.com" \
--path "/admin" \
--status 200 \
--size 1234 \
--subsystem "Web Application"
Parameters:
--host-ip- Target host IP (required)--url- Base URL (required)--path- Discovered path (required)--status- HTTP status code (optional)--size- Response size (optional)--tool- Tool used (default: ffuf)--subsystem- Subsystem name (optional)
Database location: ./data/results.db
Related skills: results-storage - Query data, generate reports
Assets
assets/common-dirs.txt- Common directory namesassets/common-files.txt- Common file namesassets/hidden-files.txt- Hidden and backup filesassets/api-endpoints.txt- Common API endpoints
Related Skills
0X6C7879/wooyun-legacy
development
VerifiedTrustedCommunity
WooYun-derived business-logic testing methodology for web apps and APIs. Use when the request involves 支付、退款、订单、越权、认证、授权、价格篡改或业务流程绕过 review, especially black-box probing for price tampering, account takeover, and process bypass flaws.
2SKILL.mdUpdated Apr 28, 2026
0X6C7879/windows-privilege-escalation
tools
VerifiedTrustedCommunity
Escalate privileges on Windows systems using service misconfigurations, DLL hijacking, token manipulation, UAC bypasses, registry exploits, and credential dumping. Use when performing Windows post-exploitation or privilege escalation.
2SKILL.mdUpdated Apr 28, 2026
0X6C7879/tunnel
development
VerifiedTrustedCommunity
Use when performing AD pentest tunneling and pivoting, especially with Ligolo-ng, Chisel, frp, proxychains, SSH forwarding, SOCKS relays, reverse tunnels, or when internal reachability is the main blocker.
2SKILL.mdUpdated Apr 28, 2026
0X6C7879/threat-modeling
development
VerifiedTrustedCommunity
Threat model, security audit, find vulnerabilities, check security of my app, risk assessment, penetration test prep, analyze attack surface, what could an attacker exploit. Use this skill whenever a user wants holistic security analysis of a codebase, application, or project. MUST be invoked instead of analyzing security yourself — it runs a specialized 8-phase STRIDE workflow producing professional deliverables you cannot generate alone: risk assessment reports, DFD diagrams, threat inventories, attack path validation, mitigation plans, and pentest plans. Trigger on: 威胁建模, 安全评估, 渗透测试, 安全分析, 安全审计, 安全检查, 风险评估. NOT for: fixing one specific bug, adding one security feature (rate limiting, CORS), writing tests, CI/CD setup, or debugging errors.
2SKILL.mdUpdated Apr 22, 2026