TryHackMe Enumeration Easy

Web Enumeration & Content Discovery Methodology

Methodology for discovering hidden directories, files, and endpoints using wordlists and automated tools. Includes analysis of discovered endpoints for vulnerability assessment.

View on GitHub
Date

2025

Tools

4

Skills

4

Platform

TryHackMe

Overview

A structured approach to web application enumeration and content discovery, essential for building a comprehensive attack surface map.

Methodology

1. Initial Reconnaissance

  • DNS enumeration
  • Subdomain discovery
  • Technology fingerprinting

2. Directory Enumeration

  • Wordlist selection strategy
  • Extension brute-forcing
  • Recursive directory scanning

3. File Discovery

  • Backup file detection
  • Configuration file exposure
  • Source code disclosure

4. Endpoint Analysis

  • API endpoint enumeration
  • Parameter discovery
  • Hidden functionality identification

Wordlist Strategy

  • Small: Quick initial scan (common.txt)
  • Medium: Standard assessment (directory-list-2.3-medium.txt)
  • Large: Deep assessment (raft-large-*.txt)
  • Custom: Application-specific paths