Merge a curated scan and your own wordlist into one surface

applied · 80 min · Objective 2.2

Task

Enumerate a lab web server two ways — with a curated database and with a target-specific wordlist you build — then merge them into one map of the site's real surface, which is a better artifact than either tool's output. Objective 2.2 is enumeration, and the merge is where it becomes usable.

Steps

  1. On the lab web server you own, seed content of two kinds: common paths a general database would know (a default admin path, a sample script) and target-specific paths built from a made-up organisation's vocabulary (a project codename, an office location).
  2. From the attacker VM, run a curated web scan (nikto-style) and save to /tmp/curated.txt.
  3. Build a wordlist from the target's own vocabulary and run directory enumeration with it, saving to /tmp/wordlist-run.txt.
  4. Confirm each tool found things the other missed: the curated scan finds the generic paths, your wordlist finds the target-specific ones.
  5. Merge both into /tmp/surface.md, one line per path with the status it returned, deduplicated.
  6. Feed forward: mark which paths take input (candidates for Domain 4) and which are administrative interfaces (where lockout rules apply).

Verify

sort -u /tmp/surface.md | wc -l
grep -ciE "codename|office|proj" /tmp/surface.md
grep -ciE "admin|login|upload|search|\?" /tmp/surface.md

The first count is the merged surface size — it must exceed the number of paths either single run found, which is the whole argument for running both. The second must be non-zero: your wordlist found the target-specific paths a general database could never contain. The third must be non-zero: you marked the paths that feed Domain 4, which is what makes this map an input rather than a pile.

Notes

A curated database knows things you would never guess; a target-specific wordlist knows things no general database can contain. Running only one is how testers miss half the surface. The merged map, with what each path returned, is the artifact that makes the web findings coherent — and the input-taking paths are where lessons 30 to 32 begin. All of it ran against a server you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.