@GHOSTontheWire said:
But for host discovery why we need fuzzing.
With CTFs there are some technical differences than in the real world - for example, DNS queries dont have the same results and you cant lookup an IP to do a reverse DNS and find all the servers it hosts. This means you need to do some slightly artificial fuzzing to find out how servers respond to various requests.