While using nessus to verify security on some of my servers I noticed it checks for certain directories on web servers. This is done by a plugin written my H D Moore that contains 685 common directory names. This makes me wonder... is there a tool that will attempt to find "hidden" directories on a web server using either a dictionary or brute force?