Lion Cipher Lab
Find hidden web paths with Gobuster
- Penetration Testing / Red Team
- Beginner
- ~55 min
- Free · no account required
Why it matters
Every web app is bigger than the links you can see. Behind the pages the site shows you, there are almost always other paths — an old admin panel, a forgotten backup file, an internal upload folder, a leftover test page — that exist and respond, but that nothing on the site links to. Developers often assume that because a page is not linked, nobody will find it. That assumption is wrong, and proving why is the whole point of this lab. A directory brute force is the technique attackers and defenders both use to discover those unlinked paths: you take a long list of common path names and ask…
What you'll learn
- understanding what a URL path, an endpoint, and an unlinked page actually are
- understanding what a directory brute force is and why 'not linked' does not mean 'not reachable'
- understanding what a wordlist is and where the SecLists wordlists come from
- running a deliberately vulnerable practice app on your own machine with one Docker command (OWASP Juice Shop), bound to localhost
- installing Gobuster on Windows, macOS, or Linux from the official project
- getting the SecLists wordlists onto your machine and picking the right list to start with
- running your first gobuster dir scan against a target you own on localhost
- reading the results: what HTTP status codes 200, 301/302, 403, and 404 each mean when a path is discovered
- widening a scan with file extensions to find pages, backups, and config files
- explaining why hidden or unlinked content is still exposed content, and what that means for defenders
Steps in this lab
- First, the one rule that makes this legal: your machine, your target, nobody else's
- The words you need first: path, endpoint, unlinked page, directory brute force (from zero)
- Run your deliberately vulnerable target on your own machine (localhost)
- Install Gobuster (the free directory brute-forcer)
- Get a wordlist: download SecLists and pick your first list
- Run your first directory scan against your own localhost target
- Read the results: what 200, 301/302, 403, and 404 mean
- Prove the lesson: open a path nothing linked to you
- What you proved, and where it takes you