if we ever found that the website server is windows IIS server then we can do the following

• use shortscan to find whether it is vulnerable or not to expose the directories/files

site:*.edu intitle:"IIS Windows Server"

echo "<https://charakpath.com/>" | shortscan --parallel 10
echo "<https://policemdl.112.up.gov.in:72/>" | shortscan --parallel 10
echo "<https://citizen.mahapolice.gov.in/>" | shortscan --parallel 10

## use techfinder for accuracy

cat subs.txt | httpx -duc -silent -nc -title -td -server | grep -aE "IIS|IIS Windows Server|Microsoft-IIS|Windows Server" | awk '{print $1}' | unew httpx.txt

cat httpx.txt | shortscan --parallel 10 --maxtime 120

WEBREP~1.ZIP         WEBREP?.ZIP?

1. search on github
2. grep in wordlist and run ffuf

copy the keywords like [ CITIZE? , CCTNS_? , etc ]

and search for them in github using

path:/CITIZE

and use the pathnames there and try to find the path and access it

Another way is to use ffuf by grepping the keyword using regex and using those to find the directories