Finding what isn't linked

Guess the paths

Plenty of endpoints are never linked from any page — admin panels, APIs, backups. Content discovery finds them by trying a wordlist and keeping the ones that don't 404. The real tools are dirb, gobuster and ffuf; the idea is just a loop:

for p in api/ping app/login app/admin graphql app/upload app/panel nope123; do
  echo "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8080/$p) /$p"
done

In the terminal

student@vulntech:~$ for p in api/ping app/login app/admin graphql app/upload app/panel nope123; do
>   echo "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8080/$p) /$p"
> done
200 /api/ping
200 /app/login
401 /app/admin
200 /graphql
200 /app/upload
200 /app/panel
404 /nope123

Every path that answers 200 (or 401/403) is real attack surface; the 404s aren't. At scale you'd also enumerate subdomains (subfinder, DNS brute force), scrape robots.txt and JS files for endpoints, and mine certificate transparency logs.