Scout

Scout is a lightweight and efficient URL fuzzer and spider designed to uncover undisclosed VHOSTs, files, and directories on web servers. With Scout, users can quickly identify potential vulnerabilities and hidden resources, enhancing their web security assessments.

Key Features

• Integrated Word List: Scout includes a complete word list within the binary, providing maximum portability and ease of use without the need for extensive configuration. Simply aim and execute to start discovering.

Usage Instructions

Scout is operated via command-line, featuring several commands for different discovery tasks:

Usage:
  scout [command]

Available Commands:
  help        Help about any command
  url         Discover URLs on a given web server.
  version     Display scout version.
  vhost       Discover VHOSTs on a given web server.

Discovering URLs

Scout allows comprehensive URL discovery with customizable capabilities:

• Specify File Extensions: Use the -x flag for file extensions you wish to target (default: php,htm,html,txt).
• Search for Specific Filenames: Use -f to specify a filename to look for.
• Custom Headers: Utilize -H to include extra headers in HTTP requests.
• HTTP Status Code Monitoring: Define positive status codes to recognize as successful findings.
• Spidering Support: Use -s to scan page content for additional links and verify their existence.

Example Command

$ scout url http://192.168.1.1

  [+] Target URL      http://192.168.1.1
  [+] Routines        10 
  [+] Extensions      php,htm,html 
  [+] Positive Codes  200,302,301,400,403,500,405,204,401,301,302

  [302] http://192.168.1.1/css
  [200] http://192.168.1.1/shares
  Scan complete. 28 results found.

Discovering VHOSTs

Scout can also help in identifying various VHOSTs related to a base domain:

$ scout vhost https://google.com

  [+] Base Domain     google.com
  [+] Routines        10 
  [+] Using SSL       true

  account.google.com
  www.google.com
  Scan complete. 12 results found.

Conclusion

Scout provides a straightforward and effective solution for web security professionals aiming to uncover hidden files and VHOSTs, facilitating thorough assessments of web exposure and security configurations.