Practical content discovery reference: ffuf and feroxbuster patterns, wordlist selection, recursion, extension fuzzing, backup/temp file hunting, and virtual host enumeration for finding hidden directories, files, and endpoints. (50 payloads)
/usr/share/seclists/Discovery/Web-Content/common.txt/usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt/usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt/usr/share/seclists/Discovery/Web-Content/<tech>.txt (tomcat.txt, jboss.txt, IIS.txt, nginx.txt)assetnote/wordlists — automated.json / httparchive_directoriescewl -d 2 -m 5 -w custom.txt https://target.com/usr/share/seclists/Discovery/Web-Content/quickhits.txtffuf -u https://target.com/FUZZ -w raft-large-directories.txt -acffuf -u https://target.com/FUZZ -w wordlist.txt -e .php,.bak,.zip,.old,.txt,.jsonffuf -u https://target.com/FUZZ -w wordlist.txt -mc 200,204,301,302,307,401,403,405 -fc 404ffuf -u https://target.com/FUZZ -w wordlist.txt -fs 1234 -fw 56 -fl 7 -fr 'Not Found'ffuf -u https://target.com/FUZZ -w list.txt -t 40 -rate 50 -p 0.1-0.5 -timeout 10ffuf -u https://target.com/FUZZ -w list.txt -H 'Cookie: session=...' -b 'auth=...' -x http://127.0.0.1:8080ffuf -u https://target.com/FUZZ -w list.txt -o out.json -of json -or -sffuf -w hosts.txt:HOST -w paths.txt:PATH -u https://HOST/PATH -mode clusterbombferoxbuster -u https://target.com -w raft-medium-directories.txtferoxbuster -u https://target.com -w list.txt -d 3 --thoroughferoxbuster -u https://target.com -w list.txt -x php,html,bak,zip,js,jsonferoxbuster -u https://target.com -w list.txt -C 404,400 -s 200,301,403 --filter-size 0ffuf -u https://target.com/FUZZ -w list.txt -recursion -recursion-depth 2 -recursion-strategy greedyferoxbuster --resume-from ferox.stateferoxbuster -u https://target.com -w list.txt --dont-scan '/logout,/exit,/static'-e .php,.php3,.php5,.phtml,.inc / -x asp,aspx,ashx,asmx / .jsp,.jspx,.do,.actionffuf -u https://target.com/index.FUZZ -w extensions.txt/usr/share/seclists/Discovery/Web-Content/raft-large-files.txt + .json/.xml/.yamlffuf -u https://target.com/FUZZ -w list.txt -e .map/usr/share/seclists/Discovery/Web-Content/LogFiles-sortbymostpopular.fuzz.txtffuf -u https://target.com/FUZZ -w list.txt -e .DS_Store,.htaccess,.htpasswd,.git-credentialsffuf -u https://target.com/index.php.FUZZ -w '.bak,.old,.orig,.save,.swp,.tmp,~,.1' (as wordlist)ffuf -u https://target.com/FUZZ -w files.txt -e .zip,.tar,.tar.gz,.tgz,.gz,.7z,.rar,.bak,.sql/usr/share/seclists/Discovery/Web-Content/BackupFiles.fuzz.txtgit clone via exposed /.git/ → git-dumper https://target.com/.git/ ./lootcurl -s https://target.com/.svn/wc.db | curl -s https://target.com/.envffuf -u https://target.com/FUZZ -w files.txt -e .config,.conf,.ini,.yml,.yaml,.properties,.xmlffuf -u https://target.com/FUZZ -w files.txt -e .phps,.php~,.inc,.bak.phpffuf -u http://TARGET_IP/ -H 'Host: FUZZ.target.com' -w subdomains.txt -acffuf -u http://TARGET_IP/ -H 'Host: FUZZ.target.com' -w subs.txt -fs 4242gobuster vhost -u http://TARGET_IP -w subs.txt --append-domainferoxbuster -u http://TARGET_IP -H 'Host: FUZZ.target.com' -w subs.txt (or) ffuf ... -mc all -fw N/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txtffuf -u http://TARGET_IP/ -H 'Host: FUZZ-dev.target.com' -w subs.txt (prefix/suffix mutations)Compare DNS-resolvable subdomains vs IP-only vhostsRecon order: robots.txt + sitemap.xml + JS files → passive (waybackurls, gau) → active bruteEstablish the soft-404 baseline: request /thisdoesnotexist-$(date) and read its status/size/wordsffuf -u https://target.com/FUZZ -w list.txt -ic -mc 200,403 -recursion -recursion-depth 1ffuf -u https://target.com/FUZZ -w list.txt -p 0.5-1.5 -t 5 -H 'User-Agent: Mozilla/5.0 ...' -timeout 15403 bypass: try /admin/ vs /admin vs /admin/. , X-Original-URL/X-Rewrite-URL headers, case/encoding tricksMatch instead of filter on huge wordlists: -mr 'admin|password|api_key' / -ms 1500-9999Always re-run finds with extensions and one recursion level deeper before moving onLevel up your security testing
Install the CLI
npx payload-playgroundExplore All Tools
Encoding, hashing, JWT & more
Browse Cheat Sheets
Quick-reference payload guides
It's a quick-reference collection of 50 Content Disco payloads for testing Content Discovery vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.
Copy any payload straight into your authorized test, or use the Subdomain Wordlist Builder to apply them interactively. Only test systems you have explicit permission to assess.
Yes — this cheat sheet and all Content Disco payloads are completely free, with no account required. Everything runs in your browser.