inventory-directory-scanner

Inventory Directory Scanner

Execute comprehensive active directory and file enumeration. Brute-force common paths, scan for backup and configuration file exposure, discover admin panels and hidden resources, and produce a structured inventory of discovered paths.

Workflow

Phase 1: Recon

1. Mount skill files:

   Read plugins/pentest/skills/web-application-mapping/SKILL.md
   Read plugins/pentest/skills/mks/SKILL.md
   

2. Establish baseline — check HTTP response behavior before scanning:

   curl -sI https://TARGET/ 2>&1 | tee outputs/ENGAGEMENT/activity/baseline-TARGET.txt
   curl -so /dev/null -w "%{http_code}" https://TARGET/THIS_PATH_DOES_NOT_EXIST_12345
   

   Record: What status code does the server return for non-existent paths? (200, 302, 404, or custom?) This baseline is critical — ffuf needs to know what "not found" looks like to filter false positives.
3. Check robots.txt and sitemap for disclosed paths:

   curl -s https://TARGET/robots.txt | tee outputs/ENGAGEMENT/activity/robots-TARGET.txt
   curl -s https://TARGET/sitemap.xml | tee outputs/ENGAGEMENT/activity/sitemap-TARGET.txt
   

4. Log:

   {"timestamp":"...","agent":"inventory-directory-scanner","action":"recon","target":"https://TARGET","404_behavior":"404","robots_paths_disclosed":3}
   

Phase 2: Experiment

1. Run ffuf with common wordlist, filtering based on baseline 404 behavior:

   ffuf -w /usr/share/seclists/Discovery/Web-Content/common.txt \
     -u https://TARGET/FUZZ \
     -mc 200,201,301,302,401,403 \
     -o outputs/ENGAGEMENT/activity/ffuf-common-TARGET.json \
     -of json \
     2>&1 | tee outputs/ENGAGEMENT/activity/ffuf-common-TARGET.txt
   

2. Run gobuster for additional coverage with medium wordlist:

   gobuster dir \
     -u https://TARGET \
     -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
     -o outputs/ENGAGEMENT/activity/gobuster-dirs-TARGET.txt \
     -b 404 \
     2>&1
   

3. Run dirsearch for backup and configuration file detection:

   dirsearch -u https://TARGET \
     -e php,asp,aspx,jsp,html,txt,conf,config,bak,backup,swp,old,db,sql,env \
     -o outputs/ENGAGEMENT/activity/dirsearch-TARGET.txt \
     2>&1
   

4. Log:

   {"timestamp":"...","agent":"inventory-directory-scanner","action":"experiment","technique":"ffuf+gobuster+dirsearch","paths_found":43,"interesting":["/.env","/.git","admin/","backup/"]}