# Discoverer

> CatSuite Discoverer: how to use and configure path, parameter and endpoint discovery with wordlists, HTTP methods, controlled pacing and automatic 429 backoff.

- Language: en
- Canonical URL: https://netcattest.com/catsuite/en/docs/modules/discoverer
- Section: Modules
- Updated: 2026-10-06
- Other language (pt-BR): https://netcattest.com/catsuite/docs/modulos/descobridor

The **Discoverer** is CatSuite's content discovery module: it walks a **wordlist** of paths or parameters and applies each entry to a **base URL** that carries the `$CAT$` marker, testing combinations against an authorized target to reveal directories, endpoints and parameters that do not show up in normal browsing. The module controls pacing with **requests per second**, an extra **delay** and **automatic 429 backoff**, filters what it captures by **status** and **size**, and preserves the session so you can **pause and resume** where you left off. This page explains every concept, every option and how to configure the Discoverer step by step.

## What the Discoverer is and what it is for

The Discoverer performs content *fuzzing* (also called content discovery or directory brute forcing). Instead of relying only on a site's visible links, it tests a list of likely names — `admin`, `backup`, `api/v1`, `.git`, `id`, `token` and thousands more — and watches how the server answers each one. Paths and parameters that exist but are not published usually give themselves away through the status code, the response size or a redirect.

It is an **intermediate-level** module: you pick the wordlist, the HTTP method and the pace, then interpret the findings. The Discoverer is built to run continuously and safely on Android, reading large wordlists as a *stream* (line by line, without loading everything into memory) and respecting pacing limits so it overloads neither the target nor the device.

> [!WARNING]
> Discovery fires many requests in sequence. Use the Discoverer only against targets you are **authorized** to test. See the responsible-use rules in [Security](https://netcattest.com/catsuite/en/docs/security).

## Core concepts

Before configuring, it helps to understand the terms that appear on screen and in the logs.

- **Wordlist.** A text file with one entry per line. Each line is a candidate (a path or parameter name). The Discoverer ships built-in lists and also reads yours; see [Wordlists](https://netcattest.com/catsuite/en/docs/modules/wordlists).
- **Base URL with `$CAT$`.** The target address with the `$CAT$` marker at the exact spot where the wordlist word should go. For each entry, the Discoverer replaces `$CAT$` with the word and sends the request.
- **Candidate / keyword.** The wordlist entry being tested in that request. In the results it is shown as the **keyword**.
- **Requests per second (RPS).** The base pace: how many requests the module tries to fire each second.
- **Delay (extra delay).** An extra fixed pause between one attempt and the next, added on top of the RPS pace.
- **Effective interval.** The real spacing between requests. The Discoverer always honors the **larger** of the interval required by the RPS and the extra delay, so you never run faster than you asked.
- **429 backoff.** When the server answers `429 Too Many Requests`, the module automatically waits a few seconds before continuing, to ease the service.
- **Automatic retry.** When a request fails with a *timeout*, the module tries again automatically, up to a retry limit.
- **Initial check (pre-flight).** Before walking the wordlist, the Discoverer sends a test `GET` to the base URL to validate connectivity with the target.
- **Capture filters.** **Status** and **size** rules that decide which responses become results (matches) and which are merely processed and discarded.
- **Resumable session.** The run state is saved to disk. If the app goes to the background, closes or crashes, you can resume from the entry where you stopped.

## The Discoverer screen: panels, tabs and indicators

The module has three screens, reached from the execution screen:

- **Execution** — where you enter the URL, start the scan and watch the log and the results.
- **Settings** — wordlist, method, pace, filters and display options (the **CONFIGURAÇÕES** button / settings icon).
- **Headers** — request identity: User-Agent, Accept, Referer, Origin, IP spoofing and other headers.

### Execution screen

At the top sit the **URL com `$CAT$`** field and the settings button. Just below, a row of chips summarizes the active configuration: wordlist name, method, RPS, delay, log state (`LOG ON`/`LOG OFF`), `RETRY AUTO`/`SEM RETRY`, `429 AUTO`/`429 OFF`, compact or full counting, a headers summary and the **effective step** in milliseconds. During a run you also see `EM EXECUÇÃO` (running), `PAUSADO` (paused) or `PAUSA AUTOMÁTICA` (auto-paused).

Three indicators track progress:

| Indicator | What it shows |
| --- | --- |
| **PROCESSADAS** (processed) | How many entries have been tested, as `current / total` of the wordlist. |
| **RESULTADOS** (results) | How many responses matched the status and size filters. |
| **FALHAS** (failures) | How many attempts failed (timeout or unexpected error). |

Below the indicators are the **LOG DA EXECUÇÃO** (run log, when enabled) and **RESULTADOS DETALHADOS** (detailed results) panels. Both have a **full-screen** button, and the results panel has a **filters** button.

## Directory and parameter bases and wordlists

The Discoverer ships with two built-in bases, and you can add your own in [Wordlists](https://netcattest.com/catsuite/en/docs/modules/wordlists).

| Built-in wordlist | What it is for | Entries |
| --- | --- | --- |
| **Catsuite diretórios e API** (default) | Enumerating paths and endpoints (directories, routes and API resources). | 4,750 |
| **Catsuite parâmetros** | Testing parameter names and query/field variations. | 6,453 |

To choose a base, open **Settings → WORDLIST** and tap the list you want. The built-in bases appear first; your imported wordlists appear under **WORDLISTS DO USUÁRIO** (user wordlists) below them. If you have no custom list yet, the **ADICIONAR WORDLIST** button opens the import screen.

> [!TIP]
> Use **Catsuite diretórios e API** to map paths (`https://target.com/$CAT$`) and **Catsuite parâmetros** to discover parameters (`https://target.com/search?$CAT$=cat-suite`). Very large wordlists switch to **safe mode** and are read as a *stream*, without freezing the device.

## HTTP methods: GET, POST, PUT and DELETE

The chosen **method** is applied to every attempt generated by the wordlist. Open **Settings → MÉTODO HTTP** to change it.

| Method | When to use |
| --- | --- |
| **GET** (default) | Light reads to map paths and endpoints. The first choice for most discovery. |
| **POST** | A bodyless send to test behaviors that depend on the method (routes that answer only to POST). |
| **PUT** | Useful for variations of routes that respond to resource updates. |
| **DELETE** | Tests responses that are conditional on the DELETE method. |

> [!WARNING]
> `PUT` and `DELETE` can **change or remove** data on the target. Use them only with explicit authorization and in environments where you understand the effect of each request.

## Discoverer options and how to configure them

The table below gathers the options on the **Settings** tab. The next section explains how to adjust each one.

| Option | Values | Default | What it does |
| --- | --- | --- | --- |
| **Wordlist** | Built-in bases or your lists | Catsuite diretórios e API | The list of entries the module will walk. |
| **HTTP method** | GET, POST, PUT, DELETE | GET | The method applied to every attempt. |
| **Requests per second** | 1 to 6 | 2 | The base pace for firing requests. |
| **Extra delay** | 0, 100, 250, 500, 750, 1000 ms | 250 ms | A fixed extra pause between attempts. |
| **Automatic 429 backoff** | On / off | On | An automatic wait when a `429` arrives. |
| **Automatic retry** | On / off | On | Retries requests that fail on timeout (up to 3 attempts). |
| **Filter by status** | Codes 100–599, comma-separated | `200,204,301,302,307,308,401,403` | Which status codes become results. |
| **Filter by minimum size** | Bytes (≥ 0) | 0 (off) | The minimum response size to become a result. |
| **Show log** | On / off | On | Shows the full run log. |
| **Show compact count** | On / off | On | Abbreviates large numbers (thousand / million / billion). |
| **Enable headers** | On / off | Off | Applies the custom headers from the Headers tab. |

### Pace: requests per second

Open **REQUISIÇÕES POR SEGUNDO** and pick from **1 to 6 RPS**. Values up to 2 are lighter for long runs; 3 and 4 are balanced; 5 and 6 are more aggressive, yet still controlled for a phone. The default is **2 RPS**. This value sets the base interval between requests (1000 ms divided by the RPS, rounded up):

| RPS | Base interval |
| --- | --- |
| 1 | 1000 ms |
| 2 | 500 ms |
| 3 | 334 ms |
| 4 | 250 ms |
| 5 | 200 ms |
| 6 | 167 ms |

### Extra delay

Open **DELAY EXTRA** and pick **SEM DELAY** (0 ms) or **100, 250, 500, 750 or 1000 ms**. The delay is a fixed pause added to the pace. The Discoverer always honors the **larger interval** between the one required by the RPS and the delay: with 2 RPS (500 ms) and a 250 ms delay, the effective step stays 500 ms; with 6 RPS (167 ms) and a 500 ms delay, the effective step becomes 500 ms. The **EXECUÇÃO SEGURA** (safe execution) panel on the settings screen shows the "`N` MS EFETIVOS" value computed from your choices.

### Automatic 429 backoff

Keep **BACKOFF 429 AUTOMÁTICO** on (default) so the module slows down on its own when the server answers `429 Too Many Requests`. On the first `429` in a run, the Discoverer waits **5 seconds** before the next attempt; if the `429`s keep coming, the wait rises to **10 seconds**. When a response other than `429` arrives, the count resets. The log records each pause with the message "429 recebido. Backoff automático aplicado por `N`s antes da próxima tentativa."

### Automatic retry

With **REPETIÇÃO AUTOMÁTICA** on (default), every request that fails on a *timeout* is retried automatically, for **up to 3 attempts** total. Off, each entry is tested **once**. Failures that are not timeouts (unexpected errors) count straight as a **FAILURE** and are not retried.

### Display options

- **MOSTRAR LOG** controls the **LOG DA EXECUÇÃO** panel. With the log off, the screen shows only the results and gives them more room.
- **MOSTRAR CONTAGEM COMPACTA** abbreviates large numbers (for example, `12 mil` instead of `12.000`). Off, the indicators show the full value with a thousands separator.

## Capture filters by status and size

These two filters, on the **Settings** tab, decide what counts as a **result** during the scan.

- **Filter by status.** A comma-separated list of HTTP codes. Only responses with one of these codes become results. The default `200,204,301,302,307,308,401,403` covers success (`200`, `204`), redirects (`301`, `302`, `307`, `308`) and telling access denials (`401`, `403`). Codes from **100 to 599** are accepted. Leave the field **empty** to capture every status.
- **Filter by minimum size.** The minimum response size, in **bytes**. Responses smaller than this value are processed but do not become results. Useful for discarding short, templated error pages. The default **0** turns the size filter off.

> [!NOTE]
> These filters act at capture time. To refine afterwards, without rerunning the scan, use the **results filters** (see below). Responses that do not match are discarded from disk to save space.

## Buttons and actions

| Button / action | What it does |
| --- | --- |
| **CONFIGURAÇÕES** / **CONFIG.** | Opens the Discoverer settings tab. |
| **CONFIGURAR** | Appears instead of start when no configuration is saved yet; opens settings. |
| **INICIAR** | Starts the scan (after the initial check). |
| **PAUSAR** | Pauses the run, preserving the current wordlist position. |
| **RETOMAR** | Continues from the entry where the session was paused. |
| **PARAR** | Interrupts and ends the current run. |
| **LIMPAR** | Clears the log, results and the temporary session. |
| **SALVAR** | Saves the settings and returns to execution. |
| **CANCELAR** | Discards the changes in settings. |
| **Filter** icon | Opens the results filters. |
| **Full-screen** icon | Expands the log or the results. |
| **VER RESPONSE** | Opens the full saved response of a result. |
| **LIMPAR FILTROS** | Removes the filters applied to the results. |

### Per-result actions

Tap a result to see its details (**PALAVRA-CHAVE**/keyword, **URL**, **CONTENT-TYPE**, **LOCATION** when present, and **PRÉVIA**/preview). Long-press (or use the menu) to open the copy actions:

| Action | What it does |
| --- | --- |
| **Enviar para o Repetir** | Opens the request in the [Repeater](https://netcattest.com/catsuite/en/docs/modules/repeater). |
| **Copiar URL** | Copies the final tested URL. |
| **Copiar headers** | Copies the headers sent in the request. |
| **Copiar body** | Copies the sent body (when present). |
| **Copiar cURL** | Copies the request as a `curl` command. |

## Headers and request identity

On the **Headers** tab, turn on **ATIVAR HEADERS** to apply custom headers to **every** Discoverer request, including the initial check and the wordlist loop. With headers on, you set **User-Agent**, **Accept-Language**, **Accept**, **Content-Type**, **Referer**, **Origin**, **Sec-Fetch-Site** and an **IP spoof** (header and value). With the option off (default), the Discoverer uses the system's default headers. The `HEADERS` chip on the execution screen shows `DESATIVADOS` (off), `PADRÃO` (default) or `PERSONALIZADO` (custom).

## Step by step

### Map a target's directories

1. Open the Discoverer and tap **CONFIGURAÇÕES**.
2. Under **WORDLIST**, choose **Catsuite diretórios e API**.
3. Leave **MÉTODO HTTP** on **GET**.
4. Set **REQUISIÇÕES POR SEGUNDO** to **2** and **DELAY EXTRA** to **250 MS** (safe defaults).
5. Check **Filter by status** (default) and leave **Filter by minimum size** at `0`.
6. Tap **SALVAR**.
7. In the **URL com `$CAT$`** field, type `https://target.com/$CAT$`.
8. Tap **INICIAR**. The module runs the initial check and starts the scan.
9. Watch **PROCESSADAS**, **RESULTADOS** and **FALHAS**, and open the findings under **RESULTADOS DETALHADOS**.

### Discover parameters

1. In **CONFIGURAÇÕES → WORDLIST**, choose **Catsuite parâmetros**.
2. Save and return to execution.
3. In **URL com `$CAT$`**, place the marker on the parameter name, for example `https://target.com/search?$CAT$=cat-suite`.
4. Tap **INICIAR** and watch for status and size variations that point to valid parameters.

### Send a finding to another module

1. Under **RESULTADOS DETALHADOS**, tap the result you care about.
2. Open the action menu and tap **Enviar para o Repetir**.
3. In the [Repeater](https://netcattest.com/catsuite/en/docs/modules/repeater), adjust the request and resend it. To automate variations, take it to the [Intruder](https://netcattest.com/catsuite/en/docs/modules/intruder).

## Examples

Base URL for path enumeration:

```text
https://target.com/$CAT$
```

Base URL for parameter discovery:

```text
https://target.com/search?$CAT$=cat-suite
```

A status filter that captures success, redirects and access denials:

```text
200,204,301,302,307,308,401,403
```

A request copied from a result as a cURL command (**Copiar cURL** action):

```bash
curl 'https://target.com/api/v1/users'
```

```bash
curl -X POST -H 'Content-Type: application/json' --data-raw '{}' 'https://target.com/api/login'
```

## Pause, resume and session recovery

The Discoverer periodically saves the run state to disk. This enables:

- **Manual pause and resume.** Tap **PAUSAR** to stop at the current point and **RETOMAR** to continue from the same entry.
- **Automatic pause.** When you send the app to the background during a scan, the module pauses on its own to preserve the wordlist position (the `PAUSA AUTOMÁTICA` chip). When you return, the run resumes.
- **Recovery after shutdown.** If the app is closed or crashes, reopening the Discoverer shows a recovered-session message and lets you **RETOMAR** from the entry where you stopped, with the findings preserved.

> [!IMPORTANT]
> Session recovery depends on it being enabled in CatSuite's settings. Full responses are saved in the session's temporary files; the module keeps only the most recent sessions and clears old ones automatically.

## Common problems and FAQ

**"Inclua `$CAT$` na URL..." (include `$CAT$` in the URL)** — The base URL must contain the `$CAT$` marker at the spot where the word goes. Without it, the module does not know where to apply the wordlist.

**"A URL informada não é válida." (the URL is not valid)** — Review the address. If you leave out the scheme, the Discoverer assumes `https://` automatically and tells you.

**The initial check failed on timeout.** — Check your connection, VPN and whether the target is up before starting. The initial check is a test `GET` to the base URL.

**Lots of `429`s showing up.** — The target is rate-limiting you. Keep **automatic 429 backoff** on, lower the **RPS** and raise the **delay**. See also [Error reference](https://netcattest.com/catsuite/en/docs/reference/errors).

**No results, only processed.** — The **status** or **size** filters may be too strict. Empty the status field to capture every code, or set the minimum size back to zero.

**The configured wordlist is not available.** — Open settings and pick another wordlist, or reimport the custom list in [Wordlists](https://netcattest.com/catsuite/en/docs/modules/wordlists).

**Many FAILURES.** — Frequent timeouts point to an unstable network or a slow target. Lower the RPS, keep automatic retry on and check the connection.

## Best practices and responsible use

- Test **authorized targets only**. Discovery is intense by nature; see [Security](https://netcattest.com/catsuite/en/docs/security).
- Start with a **low RPS** and a moderate **delay**; raise the pace only once you are sure the target can take it.
- Keep **429 backoff** and **automatic retry** on for more polite behavior toward the service.
- Use the **status and size filters** to separate signal from noise right at capture.
- Forward relevant findings to the [Repeater](https://netcattest.com/catsuite/en/docs/modules/repeater) and the [Intruder](https://netcattest.com/catsuite/en/docs/modules/intruder) instead of rerunning the whole scan.

## Next step

- [Wordlists](https://netcattest.com/catsuite/en/docs/modules/wordlists)
- [Repeater](https://netcattest.com/catsuite/en/docs/modules/repeater)
- [Intruder](https://netcattest.com/catsuite/en/docs/modules/intruder)
- [Interceptor](https://netcattest.com/catsuite/en/docs/modules/interceptor)
- [Modules overview](https://netcattest.com/catsuite/en/docs/modules)