Gobuster [patched] Info

Run Gobuster on /hidden-login :

gobuster dir -u http://target.ctf/hidden-login -w /usr/share/wordlists/dirb/common.txt -x php,html Found login.php with default credentials → access granted. gobuster

Always start with a small wordlist for speed, then expand if needed. Run Gobuster on /hidden-login : gobuster dir -u

/admin (Status: 301) /backup (Status: 200) /robots.txt(Status: 200) /secret (Status: 200) Check /robots.txt → found Disallow: /hidden-login gobuster

Output full enumeration for report:

gobuster dir -u http://target.ctf -w /usr/share/wordlists/dirb/common.txt -t 20

Run Gobuster with a small wordlist first.