🧪 Typical Workflow Burp the site to observe structure and gather cookies/headers. Spider the site to collect known paths. Use Gobuster with a tailored wordlist to find hidden directories or vhosts.