Lion Cipher Lab
Read Gobuster results: find the admin panel, the backup, and the .git nobody meant to expose
- Penetration Testing / Red Team
- Intermediate
- ~30 min
- Free · no account required
Why it matters
Running a directory brute-forcer is the easy part; a wordlist and one command do it. The part that actually earns the finding is triage: a scan of a real app spits out dozens of lines, most of them worthless, and the whole value of the exercise is knowing which two or three to chase. Miss that a cluster of identical-size 200s is a wildcard responder faking every path, and you'll waste an afternoon on ghosts. Miss the single /.git/ line buried in the noise, and you'll walk past an exposure that hands an attacker your entire source code and its history. This drill builds exactly that reading…
What you'll learn
- reading a Gobuster dir report: the path, status-code and response-size columns and what each tells you
- knowing what 200, 301, 302, 401, 403 and 404 each mean in a content-discovery result
- using response SIZE (not just status) to detect a wildcard / soft-404 responder and filter its false positives
- recognising the identical-size 200 flood as noise rather than discoveries
- spotting the high-value finds: exposed .git, backup archives (.bak/.zip/.old), directory listings, upload folders, admin panels
- prioritising findings by sensitivity instead of scanning-order
- judgment: confirming access by hand rather than assuming a 200 means unauthenticated access
- authorized-testing discipline — you only ever read output from a target you own or are cleared to test
Steps in this lab
- What this drill is: read the output, don't run the scan
- The report you're triaging — read the columns first
- What each status code is telling you
- Size is the tell: spotting the wildcard / soft-404 flood
- The findings that actually matter — triage by sensitivity
- Do it better: confirm access, don't assume it
- Your triage verdict, and what you actually learned