Content & endpoint discovery

When it applies

You have a live host and need its real surface: hidden dirs, backups, admin panels, API routes, and parameters — the inputs every other skill tests.

Why it works

Apps expose far more than the UI links to. Historical URLs, JS bundles, and predictable paths reveal endpoints (and params) that were never meant to be public or were left from old versions.