/projects/orbit


Orbit


A wordlist based web fuzzer for endpoint discovery
Project on GitHub

Intro

Orbit is a lightweight wordlist based web fuzzing and content discovery tool inspired by ffuf and DirBuster, designed to discover hidden files, directories, and endpoints through automated HTTP requests. The project was built as a way to better understand how modern web enumeration and fuzzing tools work internally.


Motivation

Orbit was created as a learning project to better understand how web fuzzing and content discovery tools like ffuf and DirBuster work under the hood. The goal was to explore the core ideas behind endpoint enumeration, HTTP request handling, wordlist based discovery, and concurrency while building a simple and efficient tool from scratch. Along the way, the project became a practical way to improve understanding of web security testing, networking concepts, and performance focused tooling design.


Features & Use Cases

Below is a list of all features that orbit has:

  • Dynamic URL fuzzing using the ORBIT keyword in URLs, https://example.com/ORBIT
  • Wordlist based endpoint discovery
  • Multi threading capability for improved performance
  • Response filtering on multiple parameters such as status codes, response length etc, to reduce false positives
  • Light weight CLI based interface for quick and easy usage

Here are some usecases where orbit can be used:

  • Discovering hidden directories/files/endpoints
  • Testing web app structure and exposure
  • Learning and experimenting with web fuzzing techniques

Installation & Usage

For installation and usage, please refer to the README.md file on github. Here is the link to the github repo.


Disclaimer

Orbit is developed strictly for educational and research purposes to understand web fuzzing, content discovery, and HTTP based enumeration techniques.

The author does not take any responsibility for any misuse, damage, or illegal activity caused by this tool. Users are solely responsible for ensuring they have proper authorization before testing any systems or networks. Unauthorized use of this tool against systems you do not own or have explicit permission to test is strictly discouraged.


Bug Report/Contribution

If you happen to find any operational/security bug in this, please let me know by creating an issue on github itself.

If you feel you can improve this project or just want to contribute something to this, feel free to create a pull request on github.


Tags: | web fuzzing | web enumeration | reconnaissance | directory bruteforce | penetration testing | api discovery | wordlist based scanning |