the previous example assumed lot of knowledge about your target but in many cases where you're attacking custom web application or large -commerce systemyou won' be aware of all of the files accessible on the web server generallyyou'll deploy spidersuch as the one included in burp suiteto crawl the target website in order to discover as much of the web application as possible howeverin lot of cases there are configuration filesleftover development filesdebugging scriptsand other security breadcrumbs that can provide sensitive information or expose functionality that the software developer did not intend the only way to discover this content is to use brute-forcing tool to hunt down common filenames and directories we'll build simple tool that will accept wordlists from common brute forcers such as the dirbuster project[ or svndigger,[ and attempt to discover directories and files that are reachable on the target web server as beforewe'll create pool of threads to aggressively attempt to discover content let' start by creating some functionality to create queue out of wordlist file open up new filename it content_bruter pyand enter the following codeimport urllib import threading import queue import urllib threads target_url wordlist_file resume user_agent ""/tmp/all txtfrom svndigger none "mozilla/ ( linux rv: gecko/ firefox/ def build_wordlist(wordlist_file)read in the word list fd open(wordlist_file,"rb"raw_words fd readlines(fd close(found_resume false words queue queue(for word in raw_wordsword word rstrip(if resume is not noneif found_resumewords put(wordelseif word =resumefound_resume true print "resuming wordlist from%sresume elsewords put(wordreturn words this helper function is pretty straightforward we read in wordlist file and then begin iterating over each line in the file we have some built-in functionality that allows us to resume bruteforcing session if our network connectivity is interrupted or the target site goes down this can be achieved by simply setting the resume variable to the last path that the brute forcer tried when the