Discoverer

The Discoverer is CatSuite's content discovery module: it walks a wordlist of paths or parameters and applies each entry to a base URL that carries the $CAT$ marker, testing combinations against an authorized target to reveal directories, endpoints and parameters that do not show up in normal browsing. The module controls pacing with requests per second, an extra delay and automatic 429 backoff, filters what it captures by status and size, and preserves the session so you can pause and resume where you left off. This page explains every concept, every option and how to configure the Discoverer step by step.

What the Discoverer is and what it is for #

The Discoverer performs content fuzzing (also called content discovery or directory brute forcing). Instead of relying only on a site's visible links, it tests a list of likely names — admin, backup, api/v1, .git, id, token and thousands more — and watches how the server answers each one. Paths and parameters that exist but are not published usually give themselves away through the status code, the response size or a redirect.

It is an intermediate-level module: you pick the wordlist, the HTTP method and the pace, then interpret the findings. The Discoverer is built to run continuously and safely on Android, reading large wordlists as a stream (line by line, without loading everything into memory) and respecting pacing limits so it overloads neither the target nor the device.

Core concepts #

Before configuring, it helps to understand the terms that appear on screen and in the logs.

• Wordlist. A text file with one entry per line. Each line is a candidate (a path or parameter name). The Discoverer ships built-in lists and also reads yours; see Wordlists.
• Base URL with $CAT$. The target address with the $CAT$ marker at the exact spot where the wordlist word should go. For each entry, the Discoverer replaces $CAT$ with the word and sends the request.
• Candidate / keyword. The wordlist entry being tested in that request. In the results it is shown as the keyword.
• Requests per second (RPS). The base pace: how many requests the module tries to fire each second.
• Delay (extra delay). An extra fixed pause between one attempt and the next, added on top of the RPS pace.
• Effective interval. The real spacing between requests. The Discoverer always honors the larger of the interval required by the RPS and the extra delay, so you never run faster than you asked.
• 429 backoff. When the server answers 429 Too Many Requests, the module automatically waits a few seconds before continuing, to ease the service.
• Automatic retry. When a request fails with a timeout, the module tries again automatically, up to a retry limit.
• Initial check (pre-flight). Before walking the wordlist, the Discoverer sends a test GET to the base URL to validate connectivity with the target.
• Capture filters. Status and size rules that decide which responses become results (matches) and which are merely processed and discarded.
• Resumable session. The run state is saved to disk. If the app goes to the background, closes or crashes, you can resume from the entry where you stopped.

The Discoverer screen: panels, tabs and indicators #

The module has three screens, reached from the execution screen:

• Execution — where you enter the URL, start the scan and watch the log and the results.
• Settings — wordlist, method, pace, filters and display options (the CONFIGURAÇÕES button / settings icon).
• Headers — request identity: User-Agent, Accept, Referer, Origin, IP spoofing and other headers.

Execution screen #

At the top sit the URL com $CAT$ field and the settings button. Just below, a row of chips summarizes the active configuration: wordlist name, method, RPS, delay, log state (LOG ON/LOG OFF), RETRY AUTO/SEM RETRY, 429 AUTO/429 OFF, compact or full counting, a headers summary and the effective step in milliseconds. During a run you also see EM EXECUÇÃO (running), PAUSADO (paused) or PAUSA AUTOMÁTICA (auto-paused).

Three indicators track progress:

Below the indicators are the LOG DA EXECUÇÃO (run log, when enabled) and RESULTADOS DETALHADOS (detailed results) panels. Both have a full-screen button, and the results panel has a filters button.

Directory and parameter bases and wordlists #

The Discoverer ships with two built-in bases, and you can add your own in Wordlists.

To choose a base, open Settings → WORDLIST and tap the list you want. The built-in bases appear first; your imported wordlists appear under WORDLISTS DO USUÁRIO (user wordlists) below them. If you have no custom list yet, the ADICIONAR WORDLIST button opens the import screen.

HTTP methods: GET, POST, PUT and DELETE #

The chosen method is applied to every attempt generated by the wordlist. Open Settings → MÉTODO HTTP to change it.

Discoverer options and how to configure them #

The table below gathers the options on the Settings tab. The next section explains how to adjust each one.

Pace: requests per second #

Open REQUISIÇÕES POR SEGUNDO and pick from 1 to 6 RPS. Values up to 2 are lighter for long runs; 3 and 4 are balanced; 5 and 6 are more aggressive, yet still controlled for a phone. The default is 2 RPS. This value sets the base interval between requests (1000 ms divided by the RPS, rounded up):

Extra delay #

Open DELAY EXTRA and pick SEM DELAY (0 ms) or 100, 250, 500, 750 or 1000 ms. The delay is a fixed pause added to the pace. The Discoverer always honors the larger interval between the one required by the RPS and the delay: with 2 RPS (500 ms) and a 250 ms delay, the effective step stays 500 ms; with 6 RPS (167 ms) and a 500 ms delay, the effective step becomes 500 ms. The EXECUÇÃO SEGURA (safe execution) panel on the settings screen shows the "N MS EFETIVOS" value computed from your choices.

Automatic 429 backoff #

Keep BACKOFF 429 AUTOMÁTICO on (default) so the module slows down on its own when the server answers 429 Too Many Requests. On the first 429 in a run, the Discoverer waits 5 seconds before the next attempt; if the 429s keep coming, the wait rises to 10 seconds. When a response other than 429 arrives, the count resets. The log records each pause with the message "429 recebido. Backoff automático aplicado por Ns antes da próxima tentativa."

Automatic retry #

With REPETIÇÃO AUTOMÁTICA on (default), every request that fails on a timeout is retried automatically, for up to 3 attempts total. Off, each entry is tested once. Failures that are not timeouts (unexpected errors) count straight as a FAILURE and are not retried.

Display options #

• MOSTRAR LOG controls the LOG DA EXECUÇÃO panel. With the log off, the screen shows only the results and gives them more room.
• MOSTRAR CONTAGEM COMPACTA abbreviates large numbers (for example, 12 mil instead of 12.000). Off, the indicators show the full value with a thousands separator.

Capture filters by status and size #

These two filters, on the Settings tab, decide what counts as a result during the scan.

• Filter by status. A comma-separated list of HTTP codes. Only responses with one of these codes become results. The default 200,204,301,302,307,308,401,403 covers success (200, 204), redirects (301, 302, 307, 308) and telling access denials (401, 403). Codes from 100 to 599 are accepted. Leave the field empty to capture every status.
• Filter by minimum size. The minimum response size, in bytes. Responses smaller than this value are processed but do not become results. Useful for discarding short, templated error pages. The default 0 turns the size filter off.

Buttons and actions #

Per-result actions #

Tap a result to see its details (PALAVRA-CHAVE/keyword, URL, CONTENT-TYPE, LOCATION when present, and PRÉVIA/preview). Long-press (or use the menu) to open the copy actions:

Headers and request identity #

On the Headers tab, turn on ATIVAR HEADERS to apply custom headers to every Discoverer request, including the initial check and the wordlist loop. With headers on, you set User-Agent, Accept-Language, Accept, Content-Type, Referer, Origin, Sec-Fetch-Site and an IP spoof (header and value). With the option off (default), the Discoverer uses the system's default headers. The HEADERS chip on the execution screen shows DESATIVADOS (off), PADRÃO (default) or PERSONALIZADO (custom).

Step by step #

Map a target's directories #

1. Open the Discoverer and tap CONFIGURAÇÕES.
2. Under WORDLIST, choose Catsuite diretórios e API.
3. Leave MÉTODO HTTP on GET.
4. Set REQUISIÇÕES POR SEGUNDO to 2 and DELAY EXTRA to 250 MS (safe defaults).
5. Check Filter by status (default) and leave Filter by minimum size at 0.
6. Tap SALVAR.
7. In the URL com $CAT$ field, type https://target.com/$CAT$.
8. Tap INICIAR. The module runs the initial check and starts the scan.
9. Watch PROCESSADAS, RESULTADOS and FALHAS, and open the findings under RESULTADOS DETALHADOS.

Discover parameters #

1. In CONFIGURAÇÕES → WORDLIST, choose Catsuite parâmetros.
2. Save and return to execution.
3. In URL com $CAT$, place the marker on the parameter name, for example https://target.com/search?$CAT$=cat-suite.
4. Tap INICIAR and watch for status and size variations that point to valid parameters.

Send a finding to another module #

1. Under RESULTADOS DETALHADOS, tap the result you care about.
2. Open the action menu and tap Enviar para o Repetir.
3. In the Repeater, adjust the request and resend it. To automate variations, take it to the Intruder.

Examples #

Base URL for path enumeration:

https://target.com/$CAT$

Base URL for parameter discovery:

https://target.com/search?$CAT$=cat-suite

A status filter that captures success, redirects and access denials:

200,204,301,302,307,308,401,403

A request copied from a result as a cURL command (Copiar cURL action):

curl 'https://target.com/api/v1/users'

curl -X POST -H 'Content-Type: application/json' --data-raw '{}' 'https://target.com/api/login'

Pause, resume and session recovery #

The Discoverer periodically saves the run state to disk. This enables:

• Manual pause and resume. Tap PAUSAR to stop at the current point and RETOMAR to continue from the same entry.
• Automatic pause. When you send the app to the background during a scan, the module pauses on its own to preserve the wordlist position (the PAUSA AUTOMÁTICA chip). When you return, the run resumes.
• Recovery after shutdown. If the app is closed or crashes, reopening the Discoverer shows a recovered-session message and lets you RETOMAR from the entry where you stopped, with the findings preserved.

Common problems and FAQ #

"Inclua $CAT$ na URL..." (include $CAT$ in the URL) — The base URL must contain the $CAT$ marker at the spot where the word goes. Without it, the module does not know where to apply the wordlist.

"A URL informada não é válida." (the URL is not valid) — Review the address. If you leave out the scheme, the Discoverer assumes https:// automatically and tells you.

The initial check failed on timeout. — Check your connection, VPN and whether the target is up before starting. The initial check is a test GET to the base URL.

Lots of 429s showing up. — The target is rate-limiting you. Keep automatic 429 backoff on, lower the RPS and raise the delay. See also Error reference.

No results, only processed. — The status or size filters may be too strict. Empty the status field to capture every code, or set the minimum size back to zero.

The configured wordlist is not available. — Open settings and pick another wordlist, or reimport the custom list in Wordlists.

Many FAILURES. — Frequent timeouts point to an unstable network or a slow target. Lower the RPS, keep automatic retry on and check the connection.

Best practices and responsible use #

• Test authorized targets only. Discovery is intense by nature; see Security.
• Start with a low RPS and a moderate delay; raise the pace only once you are sure the target can take it.
• Keep 429 backoff and automatic retry on for more polite behavior toward the service.
• Use the status and size filters to separate signal from noise right at capture.
• Forward relevant findings to the Repeater and the Intruder instead of rerunning the whole scan.

Next step #

• Wordlists
• Repeater
• Intruder
• Interceptor
• Modules overview