> struggle to detect endpoints not explicitly utilized by the web front-end
Currently I'd use dirbuster or similar to try to find hidden paths. From there the approach is application specific.
Currently I'd use dirbuster or similar to try to find hidden paths. From there the approach is application specific.
You may also like https://github.com/assetnote/kiterunner
And I do understand this is a part of your manual penetration testing routine.
But what about semi-automated tools, are you aware of any a small mobile app team could configure and run to continuously monitor the security of their app?