[StubbyBoy]

Ive tried a couple but they dont seem to work. Sc0rpion doesnt seem to work, nor does any other Ive found.

All help will be appreciated.
Thanks.

[618C]

i think you are looking for a Fuzzer
something that fuzzes URLs to see what hits ?

like wp-admin or wp-login right ?

Github is full with decent http fuzzers.

[StubbyBoy]

Yes. Thanks for your help.

Edit: Is there one u know?

[JustHackIt]

Just try dirb. Also the admin panel can be on subdomain, so sublist3r

[Beladonis]

Gobuster and ffuf are, in my opinion, the best fuzzers out there. But you need to know the concept of HTTP responses (mainly status code and content length) to use those tools.

The admin page can be anywhere, within an obvious directory like "admin" or an obscure one unintelligibly named "QWE-_pLD123-4", at the root of the website, on another port, and sometimes there is no login page because the website is managed through SSH or FTP or a customer control panel. The mission is to guess the location, by querying the server and listening to the response codes.

That is basically how it works:

-Hello server.com, do you have a directory called "admin"?
-No. (404 not found)
-What about "administrator"?
-No. (404 not found)
-"administration"?
-None of your business. (403 forbidden)
-Hmmm interesting. Is there a file called login.php file under the "administration" directory?
-No. (404 not found)
-"login.html"?
-Yes, but it's redirected to "login". (301 redirect)
-Can you serve me server.com/administration/login ?
-Yes. (200 found)

Our login page is at /administration/login

As you can see, you first need to guess the directory then the login page. Sometimes you are lucky and it's easy to find, sometimes if the webmaster was cautious, it can be very hard - if not impossible. And sometimes the web server is configured to reply 404 NOT FOUND even for resources that actually exists, making it even harder.

You see in the example above we have asked the server for directory names, well there are wordlists containing tons of those, you can find good one here ->
https://github.com/fuzzdb-project/fuzzdb/
https://github.com/danielmiessler/SecLists/



You have to check some things before trying to fuzz your target though, like, what file extension seems to be used?
Is url rewrite engine on?
Are they making use of a CMS? What is it?
What is the server response if you add a trailing slash, is it 404, 301, 302 or 200, or other?
Is the webserver behind cloudflare or any other reverse proxy / WAF services, which could eventually slow down or give incorrect results?

Then you adapt accordingly.

[Spaced]

I'm with @Beladonis and @PenTesting on this.

Gobuster would be my goto. Using the vhost scan for subdomains and grab the lists from the SecList github: https://github.com/danielmiessler/SecLists/

Depending on how much time you have to spare, I've found having a separate machine with a combination of a lot of wordlists works well - but just time consuming.