> ## Documentation Index > Fetch the complete documentation index at: https://docs.vigolium.com/llms.txt > Use this file to discover all available pages before exploring further. # Deparos - Modern Adaptive Content Discovery > Intelligent content discovery engine that adapts its strategy dynamically using fingerprint-based soft-404 detection. Deparos is an intelligent content discovery engine that performs directory enumeration, directory fuzzing, and endpoint discovery against web applications. It goes beyond static wordlist brute-forcing by learning from every response - adapting its strategy, growing its wordlists dynamically, and filtering false positives through fingerprint-based soft-404 detection. ## How It Works ``` Target URL │ ▼ ┌──────────────────────────────────────────────────────┐ │ Initialization │ │ 1. Probe target, extract host components │ │ 2. Fetch robots.txt │ │ 3. Learn baseline fingerprints (3-sample soft-404) │ │ 4. Load prior session data (if resuming) │ │ 5. Generate initial tasks from wordlists + observed │ └──────────────────┬───────────────────────────────────┘ ▼ ┌──────────────────────────────────────────────────────┐ │ Priority Queue │ │ ┌────┬────┬────┬────┬─────┬──────┬──────┬────────┐ │ │ │ P0 │ P1 │ P2 │ P4 │ P5 │ P7 │ P11 │ P12 │ │ │ │Spdr│Obs │Obs │Obs │Short│ExtVar│Long │Fuzz │ │ │ │ JS │Name│File│Dir │Word │Numric│Word │ │ │ │ └────┴────┴────┴────┴─────┴──────┴──────┴────────┘ │ └──────────────────┬───────────────────────────────────┘ ▼ ┌──────────────────────────────────────────────────────┐ │ Payload Coordinator │ │ Expander pulls tasks → Expand() yields payloads │ │ N workers execute payloads concurrently │ │ │ │ For each response: │ │ Fingerprint check (soft-404?) ──→ discard │ │ WAF detection ──→ track/backoff │ │ Real discovery ──→ callbacks │ └──────────────────┬───────────────────────────────────┘ ▼ ┌───────────────────────────────────────────────────────┐ │ Discovery Callbacks │ │ OnDirectoryDiscovered(): │ │ • Learn new fingerprints for directory │ │ • Create recursive tasks (wordlists + observed) │ │ • Extract breadcrumb directories │ │ OnFileDiscovered(): │ │ • Extract extension → trigger extension tasks │ │ • Numeric segment → fuzz ±10 variations │ │ • Queue extension variant probes (.bak, .old, …) │ └──────────────────┬────────────────────────────────────┘ ▼ ┌──── loop back to Priority Queue ────┐ │ (new tasks from discoveries) │ └─────────────────────────────────────┘ ``` ## What Makes It Adaptive ### 1. Fingerprint-Based Soft-404 Detection Before scanning, the engine requests 3 random non-existent paths and extracts response attributes (status code, content-type, headers, body hash, content-length ranges). Only attributes **stable across all 3 samples** become the baseline signature. During scanning, responses matching this signature are discarded as false positives. When an unknown response pattern appears, a 4-strategy wildcard validation (prefix, suffix, extension, middle) confirms whether the discovery is real or a new soft-404 variant - and learns the new pattern. ### 2. Observed Collection System Four data pools grow continuously during the scan: | Pool | Source | Priority | | ------------------- | ---------------------------------------------------- | -------- | | Observed Names | Spider links, JS parsing, response body tokenization | P1 | | Observed Files | Complete filenames from discoveries | P2 | | Observed Extensions | File extensions from discoveries | P5 | | Observed Paths | Full path segments from URLs | P4 | Every newly discovered directory is probed with ALL observed values as high-priority tasks. When a new extension is found for the first time, it triggers tasks across ALL known directories. ### 3. JavaScript Intelligence Two layers of JS analysis feed endpoints back into the discovery queue: * **JSScan** (embedded binary): Deobfuscates bundled JS, resolves string concatenation, traces variable assignments, and extracts `fetch()` / `XMLHttpRequest` / `$.ajax` call sites into full HTTP request specs. * **Spider extractors**: Parse inline `