Which technique is commonly used to discover hidden directories and files on a web server?

Certificate transparency log review

You are mapping a web application and need to discover hidden administrative endpoints. The application uses a custom framework, and you have a wordlist of common admin paths. Which tool and technique would be most appropriate?

Use Burp Suite's spider to crawl the application and follow all links

Use the browser's developer tools to view the page source and find hidden links

Use ffuf with the wordlist against the base URL and filter by response size

Use Nmap's http-enum script with the wordlist

A penetration tester is conducting passive reconnaissance on a target that uses a content delivery network (CDN) to front its web application. The tester wants to discover the origin server's IP address to potentially bypass the CDN during later active testing. Which passive technique is most likely to reveal the origin IP?

Search for DNS history records that may show the origin IP before the CDN was implemented.

Perform a reverse DNS lookup on the CDN's IP range to identify the origin server.

Send a request to the CDN with a modified Host header to see if the origin responds directly.

Use a certificate transparency log to find certificates issued to the origin domain, which may include the IP address.

During an authorized penetration test, you need to identify the web server software and framework of a target application. The client asks you to keep the number of requests low to avoid alerting the SOC. Which approach is most effective?

Send a single HTTP OPTIONS request and analyze the Allow header

Perform a full TCP connect scan on all ports to identify the web server

Issue one GET request to the root and inspect the Server header and X-Powered-By header

Use Nmap with the http-title script against the web server port

A tester is mapping a web application and wants to discover unlinked administrative endpoints. The application is known to use a REST API under /api/v1/. The tester has a wordlist of common directory names but wants to minimize the number of requests to avoid triggering rate-limit alerts. Which approach is most efficient?

Run a recursive directory brute-force starting at the root with a large wordlist, allowing the tool to follow discovered directories.

Perform a targeted brute-force of /api/v1/ with a curated wordlist of common admin paths and observe response codes.

Query search engines for site:target.com inurl:admin to find indexed administrative pages.

Use a spider to crawl the application from the login page, following all links and parsing JavaScript for API endpoints.

GIAC Web Application Penetration Tester

Domain 2Objective 1

Reconnaissance and Mapping GWAPT Practice Questions (Page 9)

Part of the Information Gathering and Tooling domain, which makes up ~31% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~22–37 in this domain), expect 11–19 from this objective — we provide 50 practice questions to prepare you well beyond it. (estimate)

50questions here

10free pages

7concepts

Questions 41–45

41foundation · easy
Which technique is commonly used to discover hidden directories and files on a web server?
Select an answer first
42application · medium
You are mapping a web application and need to discover hidden administrative endpoints. The application uses a custom framework, and you have a wordlist of common admin paths. Which tool and technique would be most appropriate?
Select an answer first
43expert · hard
A penetration tester is conducting passive reconnaissance on a target that uses a content delivery network (CDN) to front its web application. The tester wants to discover the origin server's IP address to potentially bypass the CDN during later active testing. Which passive technique is most likely to reveal the origin IP?
Select an answer first
44application · medium
During an authorized penetration test, you need to identify the web server software and framework of a target application. The client asks you to keep the number of requests low to avoid alerting the SOC. Which approach is most effective?
Select an answer first
45application · medium
A tester is mapping a web application and wants to discover unlinked administrative endpoints. The application is known to use a REST API under /api/v1/. The tester has a wordlist of common directory names but wants to minimize the number of requests to avoid triggering rate-limit alerts. Which approach is most efficient?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GWAPT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GWAPT” is a trademark of its owner, used for identification only.

Reconnaissance and Mapping GWAPT Practice Questions (Page 9)

Questions 41–45

Which technique is commonly used to discover hidden directories and files on a web server?

You are mapping a web application and need to discover hidden administrative endpoints. The application uses a custom framework, and you have a wordlist of common admin paths. Which tool and technique would be most appropriate?

During an authorized penetration test, you need to identify the web server software and framework of a target application. The client asks you to keep the number of requests low to avoid alerting the SOC. Which approach is most effective?

Keep studying — Information Gathering and Tooling