title: How would you attack a domain to look for "unknown" resources?
body: <p>Given a domain, is it possible for an attacker to discover one or many of the pages/resources that exist under that domain?  And what could an attacker do/use to discover resources in a domain?</p>
  
  <p>I have never seen the issue addressed in any security material (because it's a solved problem?) so I'm interested in ideas, theories, best-guesses, in addition to practices; anything an attacker could use in a "black box" manor to discover resources. </p>
  
  <p><hr />
  Some of the things that I've come up with are:</p>
  
  <ul>
  <li>Google -- if google can find it, an attacker can.
  <li>A brute force dictionary attack --  Iterate common words and word combinations (Login, Error, Index, Default, etc.)  As well, the dictionary could be narrowed if the resource extension was known (xml, asp, html, php.) which is fairly discoverable.
  <li>Monitor traffic via a Sniffer -- Watch for a listing of pages that users go to.  This assumes some type of network access, in which case URL discovery is likely small peanuts given the fact the attacker has network access.
  </ul>
  
  <p><strong>Edit</strong>: Obviously directory listings permissions are turned off.</p>