dir — Windows file and directory enumeration

dir lists files and directories from Windows Command Prompt. During CTFs and authorised enumeration it is useful for quickly mapping a filesystem, locating unusual files and identifying configuration files before inspecting their contents.

The /a option includes files with special attributes such as hidden and system files.

/s searches recursively through subdirectories. This is one of the most useful options during filesystem enumeration.

/b produces bare output containing only paths or filenames. It is much easier to pipe into other commands such as findstr.

/a-d excludes directories and returns only files.

Before searching file contents, filename enumeration can reveal obvious artefacts such as flag.txt, proof.txt, user.txt or configuration backups.

Recursive searches often encounter directories that the current user cannot access. Redirecting STDERR to nul hides access-denied messages and keeps the output readable.

Searching a user profile is usually faster and less noisy than immediately scanning the entire system drive.

Desktop, Documents and Downloads are common locations for CTF artefacts, scripts, notes and configuration files.

C:\Users reveals which local user profiles exist and can provide additional locations worth inspecting.

Configuration data is commonly stored in INI, CFG, CONF, CONFIG, XML, JSON, YAML and script files.

A small FOR loop can enumerate several common configuration and script extensions without manually repeating every command. In interactive CMD use a single percent sign.

C:\ProgramData stores application-wide configuration and data. In CTF environments it is often worth checking because installed applications may leave configuration, log or backup files here.

Applications frequently store per-user configuration in AppData. Both Roaming and Local can contain application settings, scripts, caches and configuration artefacts.

On IIS systems the default web root is commonly C:\inetpub\wwwroot. Web application files can reveal configuration files, scripts and CTF artefacts.

Windows setup information may remain under the Panther directories. In training environments these files can be useful enumeration targets.

PowerShell command history can reveal commands previously executed by the current user. The default PSReadLine history commonly exists below the roaming AppData directory.

A full recursive search can produce a large amount of output and should generally come after targeted enumeration.

A practical workflow is to enumerate the current profile first, inspect application and web directories next, search interesting filenames and extensions, and only perform a full-drive recursive search if targeted searches do not reveal anything.