80, 443 - HTTP/S

ffuf -u http://TARGET:PORT/FUZZ -w /PATH/words.txt -rate 10 -t 10 -r=false -recursion=false -maxtime 120 -of json -o ffuf-bounded.json
ffuf -u http://TARGET:PORT/FUZZ -w /PATH/words.txt -rate 25 -t 20 -r=false -recursion=false -ac -of json -o ffuf-calibrated.json

The time limit is seconds and can leave partial coverage. Use auto-calibration when uniform missing-page responses obscure results; inspect its filters because legitimate responses can resemble the baseline. Use the relevant authenticated/vhost/parameter or recursive method below when that is the missing context.

Use the actual cookie from a valid session; check that a request returns protected content rather than a login page.

ffuf -u http://HOST:PORT/FUZZ -w /PATH/words.txt -b 'SESSION=VALUE' -mc all -ac -rate 25 -o authenticated.json -of json

For a request with custom headers or a body, save it with FUZZ only in the intended field. A raw request does not encode its transport:

ffuf -request request.txt -request-proto http -w /PATH/words.txt -mc all -ac -rate 25 -o request-results.json -of json

Use -request-proto https for TLS. Expired cookies and one-use CSRF tokens require a fresh request; a stale request does not establish absent content. For a remaining directory-depth question:

ffuf -u http://HOST:PORT/FUZZ -w /PATH/words.txt -recursion -recursion-depth 1 -rate 25 -o recursive.json -of json

This adds one level of recursive discovery, not another identical baseline pass. Review redirects and missing-page responses before expanding coverage. ffuf request and discovery options.

General purpose automatic scanners:

nikto -h <URL>
whatweb -a 4 <URL>
wapiti -u <URL>
zaproxy #You can use an API
nuclei -ut && nuclei -target <URL>

w3af is an inherited Python 2-era reference, not a supported current-Kali installation path. Its old launch command is omitted rather than recommending obsolete dependencies.

These broad examples are not the exam baseline. Do not run an unreviewed template/plugin set merely because a scanner is installed.

• dir: directory brute-forcing mode.
• -t <n>: number of concurrent threads (default 10).
• -w <wordlist>: path to the wordlist.
• -u <URL>: target URL.

Optional Kali alternative for recursive content discovery. Upstream.

sudo apt install feroxbuster

Check on Kali:

feroxbuster --version

Optional Kali alternative for path discovery. Upstream.

sudo apt install dirsearch

Check on Kali:

dirsearch --help

Optional Rust-based web discovery tool. The config and technology wordlists are required even when the binary builds successfully. The three filename corrections below align the upstream profile with its case-sensitive wordlist checkout. Preserve an existing ~/.config/chameleon installation and review its paths instead of overwriting it. Compilation requires a compatible Rust toolchain; do not use its installer as an opaque substitute for reviewing dependencies. Upstream.

sudo apt install cargo build-essential perl pkg-config
git clone --depth 1 https://github.com/iustin24/chameleon.git "$HOME/oscp/tools/repos/chameleon"
cargo build --release --manifest-path "$HOME/oscp/tools/repos/chameleon/Cargo.toml"
mkdir -p "$HOME/.config/chameleon"
git clone --depth 1 https://github.com/iustin24/chameleon-wordlists.git "$HOME/.config/chameleon/wordlists"
( set -o noclobber; sed -e 's@/GO.txt@/Golang.txt@g' -e 's@/umbraco.txt@/Umbraco.txt@g' -e 's@/Joommla.txt@/Joomla.txt@g' "$HOME/oscp/tools/repos/chameleon/config.toml" > "$HOME/.config/chameleon/config.toml" )

Check on Kali:

"$HOME/oscp/tools/repos/chameleon/target/release/chameleon" --help
python3 - <<'PY'
import pathlib, tomllib
config = pathlib.Path.home() / ".config/chameleon/config.toml"
data = tomllib.loads(config.read_text())
def check(value):
    if isinstance(value, dict):
        for child in value.values():
            check(child)
    elif isinstance(value, str) and value.startswith("~/"):
        path = pathlib.Path(value).expanduser()
        assert path.is_file(), f"Missing configured file: {path}"
check(data)
PY

Optional general-lab web proxy/scanner. This does not approve active scanner/automation features for the exam; follow the feature-specific restrictions in the owning section. Upstream.

sudo apt install zaproxy

Check on Kali:

zaproxy -version