Mapping endpoints

Knock on every door

An app is more than its landing page. You find hidden paths by requesting candidates and watching the status code: 200 (or 301/302/403) means something is there; 404 means it isn't. A tiny loop probes a handful of guesses:

for p in '' api/ping admin login backup; do
  code=$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:8080/$p")
  echo "$code  /$p"
done

In the terminal

student@vulntech:~$ for p in '' api/ping admin login backup; do
>   code=$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:8080/$p")
>   echo "$code  /$p"
> done
200  /
200  /api/ping
404  /admin
404  /login
404  /backup

Two paths answer 200 and the rest 404 — you've just mapped the app's real surface.

Tip: Real engagements use a wordlist of thousands of names instead of five. dirb and nikto (both installed here) do exactly this loop at scale — dirb http://127.0.0.1:8080/ for paths, nikto -h http://127.0.0.1:8080/ for known issues. They're noisy, so save them for when you're allowed to be loud.