Typorithm · medium

Web Recon

web-reconpentestcontent-discoveryfuzzingfingerprint

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Web Recon

Recon & OSINT

Web recon brute-forces directories, files, and virtual hosts with content-discovery tools (ffuf, gobuster), then fingerprints the technology stack (whatweb, Wappalyzer, nuclei). Identifying frameworks and versions maps the target to known CVEs to investigate next — all within the authorized scope.

Once live web hosts are known, content discovery brute-forces directories, files, and virtual hosts with ffuf, gobuster, or feroxbuster. These tools reveal unlinked paths — admin panels, backups, API routes — that the application never links to.

ffuf substitutes its FUZZ keyword for each wordlist entry; gobuster dir does the same with a directory wordlist like raft.txt. Both send real requests, so they run only against authorized hosts.

Technology fingerprinting with whatweb, Wappalyzer, and nuclei identifies the web server, framework, CMS, and their versions. Mapping those versions to known CVEs turns the recon output into a prioritized list of vulnerabilities to investigate next.

ffuf/gobuster brute-force hidden directories and files.

FUZZ is ffuf's placeholder for each wordlist entry.

whatweb/Wappalyzer/nuclei fingerprint the stack to CVEs.

ffuf -u https://target/FUZZ -w dirs.txt
gobuster dir -u https://target -w raft.txt
whatweb target.com
# wappalyzer + nuclei fingerprint the stack

Read the implementation

Connect each part of the code to the concept before you type.

1. Directory fuzzing

ffuf replaces the FUZZ keyword with each wordlist entry to brute-force hidden directories and files on the in-scope host.

ffuf -u https://target/FUZZ -w dirs.txt

2. Content discovery

gobuster dir walks a wordlist against the URL to find unlinked paths the application never advertises.

gobuster dir -u https://target -w raft.txt

3. Tech fingerprint

whatweb inspects headers and responses to identify the web server, framework, and CMS in use.

whatweb target.com

4. Stack fingerprint

Wappalyzer and nuclei detect frameworks and versions, which map to known CVEs worth investigating next.

# wappalyzer + nuclei fingerprint the stack

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.