Overview
Endpoint discovery maps an application's reachable routes (paths/URLs) — including unlinked ones — building the detailed surface to test. This lesson covers route discovery.
Learning objectives
- Explain route/path discovery.
- Describe finding linked and unlinked routes.
- Connect routes to the application attack surface.
Core concept
Routes are an application's paths/URLs — its pages and endpoints. Route discovery maps them comprehensively, including unlinked routes (admin panels, backups, hidden or old endpoints) that are reachable but not referenced in the visible UI. This is the bug bounty application of the content-discovery technique (from ethical-hacking web-enumeration): expanding the known web attack surface beyond what browsing reveals, using crawling for linked routes and probing candidate paths (via response codes) for unlinked ones — within scope and mindful of request volume.
How it works
The researcher combines crawling (following links to map the visible application) with probing candidate paths (using response status codes to infer which unlinked routes exist). This surfaces both the navigable application and hidden-but-reachable routes — each a potential test target added to the surface map. Discovered routes are checked against scope, and probing is paced (many requests). Comprehensive route discovery ensures testing covers the whole application, not just its linked pages — often revealing high-value routes (admin, backups) that yield findings. It feeds parameter discovery and the vulnerability hunting that follows.
Practical example
Discovering routes on an in-scope application, the researcher crawls the linked pages and also probes for unlinked paths — finding an admin route and an old backup endpoint not referenced anywhere in the UI. These reachable-but-hidden routes are high-interest additions to the surface map. Verified in-scope, they become priority test targets (an admin interface, a potentially sensitive backup). Route discovery expanded the testable surface well beyond the visible site — exactly where many bug bounty findings originate.
Cybersecurity relevance
Route discovery is fundamental to thorough bug bounty hunting: it frequently uncovers hidden, high-value routes (admin panels, backups, debug/old endpoints) that are common sources of serious findings, and mirrors attacker content discovery. It defines the full application surface for testing. For defenders, it reinforces that "unlinked" is not "hidden/secure" — reachable routes must be protected or removed. It must respect scope and pacing (request volume). Comprehensive route discovery underpins the parameter, API, and vulnerability-testing steps.
Common mistakes
- Testing only linked pages, missing unlinked reachable routes.
- Assuming unlinked routes are safe (security by obscurity fails).
- Route discovery that ignores scope or rate limits (high request volume).
Key takeaways
- Routes are an application's paths/URLs; route discovery maps them comprehensively, including unlinked ones (admin, backups, hidden/old endpoints).
- It combines crawling (linked) with probing candidate paths (unlinked, via response codes), within scope and paced for request volume.
- It often uncovers hidden high-value routes (mirroring attacker content discovery) and defines the full surface; defenders must protect reachable routes rather than rely on obscurity.
Check your understanding
- Why is discovering unlinked routes important, and why doesn't "unlinked" mean "secure"?
- What two techniques combine to comprehensively discover an application's routes?