Fuzzing Workflow

Run web fuzzing and enumeration against the target URL.

Target

Target: $ARGUMENTS

Fuzzing targets are typically URLs (e.g., http://localhost:8080). If no target was provided, ask the user for a target URL. Verify the host portion is in .pentest/scope.json (run cat .pentest/scope.json to check). If not in scope, ask the user to add it with /scope add <target>.

Environment Detection

• Wrapper scripts available: !test -f scripts/gobuster/discover-directories.sh && echo "YES" || echo "NO"

Steps

1. Directory Discovery

Brute-force discover hidden directories and files on the web server. Hidden admin panels, backup files, and configuration endpoints are high-value findings.