Lion Cipher Lab
Find hidden web paths with content discovery — on a server YOU run
- Penetration Testing / Red Team
- Beginner
- ~40 min
- Free · no account required
Why it matters
Real web applications hide far more than the pages they link to: old admin panels, forgotten backup files, staging directories, upload folders. Content discovery is the technique of asking a web server, path by path, "does this exist?" and reading its answers — it's how a defender inventories what their own site actually exposes, and the first move an authorized tester makes on a web target. Almost every popular external web-pentest exercise assumes you can already do this. Learning it against a server you run yourself means you arrive at those rooms with the prerequisite already in hand,…
What you'll learn
- content and directory discovery
- running a local web server
- using gobuster or ffuf
- wordlists
- reading HTTP status codes (200 / 403 / 404)
- authorized-use discipline
Steps in this lab
- The one rule, before you discover anything
- What content discovery is, in one breath
- Stand up your own web server to practice on
- Give the server something worth finding
- Install a content-discovery tool
- You also need a wordlist
- Run your first content-discovery scan against localhost
- Read the output: 200 vs 403 vs 404
- What you just did — and why it's a prerequisite, not a party trick