In browser-recon you mapped the parts of NovaCart the user interface shows you - the markup, the API calls, the routes named in the JavaScript bundle. But a web server almost always exposes far more than it links to: backup files, debug endpoints, admin panels, metrics, log viewers, old API versions, and forgotten upload folders. None of these appear in the navigation, yet anyone who knows or guesses the path can request them.
Content discovery - also called forced browsing or directory enumeration - is the technique of systematically requesting candidate paths to find the resources that are present but unlinked.
The idea that makes it work is simple and important:
"Hidden" is not "protected." An unlinked resource is still returned to anyone who requests its URL. Only a server-side authorization check actually protects it.
In this lesson you will:
- Read
robots.txtand the sitemap and see that they are maps, not access controls - and that they often hand an attacker the sensitive paths directly. - Compare gobuster and ffuf reference commands without executing a live scan.
- Triage simulated results by HTTP status code and response size to separate real findings from noise.
- Submit one hidden path shown in the simulation - for example
/ftp,/metrics, or/support/logs.
Estimated time: 10 to 15 minutes.
Prerequisites
Complete these lessons before starting the hands-on steps:
http-fundamentals— HTTP status codes are used throughout this lesson.browser-recon— visible-surface mapping skills are the starting point for this lesson.
All hands-on work is contained in the custom Content Discovery Explorer; no Kali terminal, local server, or separate browser page is required.
A word on scope first: this lesson uses precomputed results and sends no scan traffic. Real forced browsing is active - it sends thousands of requests and places load on a server. Run it only against a target you are explicitly authorized to test, exactly as established in hacking-ethics-and-authorization.
When you are ready, send the Continue signal.