Security
  • IT Security Knowledge Base
  • Blue team
    • Linux System Hardening
    • Phishing Analysis
    • Snort
    • Yara
  • Capture the Flag
    • OverTheWire
      • Bandit
        • Bandit Level 0
        • Bandit Level 0 → Level 1
        • Bandit Level 1 → Level 2
        • Bandit Level 2 → Level 3
        • Bandit Level 3 → Level 4
        • Bandit Level 4 → Level 5
        • Bandit Level 5 → Level 6
        • Bandit Level 6 → Level 7
        • Bandit Level 7 → Level 8
        • Bandit Level 8 → Level 9
        • Bandit Level 9 → Level 10
        • Bandit Level 10 → Level 11
        • Bandit Level 11 → Level 12
        • Bandit Level 12 → Level 13
        • Bandit Level 13 → Level 14
        • Bandit Level 14 → Level 15
        • Bandit Level 15 → Level 16
        • Bandit Level 16 → Level 17
        • Bandit Level 17 → Level 18
        • Bandit Level 18 → Level 19
        • Bandit Level 19 → Level 20
        • Bandit Level 20→ Level 21
        • Bandit Level 21→ Level 22
        • Bandit Level 22 → Level 23
        • Bandit Level 23 → Level 24
        • Bandit Level 24 → Level 25
        • Bandit Level 25 → Level 26
        • Bandit Level 26 → Level 27
        • Bandit Level 27 → Level 28
        • Bandit Level 28 → Level 29
        • Bandit Level 29 → Level 30
        • Bandit Level 30 → Level 31
        • Bandit Level 31 → Level 32
        • Bandit Level 32 → Level 33
    • OWASP Juice Shop
      • Installation
      • Level 1 - Challenges
      • Level 2 - Challenges
    • TryHackMe Rooms
      • Anthem
      • Capture!
      • Corridor
      • Gotta Catch'em All!
      • Mustacchio
      • Neighbour
      • Opacity
      • Source
    • CEH v12 practical resources
  • Cryptology
    • CryptoHack
      • Course: Introduction to CryptoHack
        • Introduction - Challenges
        • General - Encoding
        • General - XOR
      • Course: Modular Arithmetic
        • General - Mathematics
        • Mathematics - Modular Math
        • Mathematics - Brainteasers Part 1
      • Course: Symmetric Cryptography
        • How AES Works
        • Symmetric Starter
        • Block Ciphers
        • Stream Ciphers
  • Red Team
    • Reconnaissance
      • Foot-printing
      • Scanning (Nmap)
      • Enumeration
    • Vulnerability Analysis
    • Initial Access
      • Obtaining credentials
      • Vulnerability Exploitation
        • Buffer Overflow
        • Metasploit and Armitage
        • Ninja Jonin
    • Active Directory
      • Connect to AD
      • AD Explore
      • CMD and PowerShell enumeration
      • Certificates in AD
      • LDAP Pass-back Attacks
      • Cracking NetNTLM Challenge with Responder
      • Exploring Configuration Files for AD Credentials
      • Pass the hash with evil WinRM
      • Understanding Runas
    • Malware
    • Sniffing
      • Intercept HTTP traffic - Hetty
      • Intercept HTTP traffic - Bettercap
      • Wireshark
    • Social Engineering
    • Denial of Service
    • Web Hacking
      • Burp Suite
      • OWASP ZAP
      • Web servers
      • Web Server Footprinting
      • Directory Enumeration
      • Session Hijacking
      • Web Shells
      • Web vulnerability scanners
      • SQL Injection
    • Cloud
    • Wireless Networks
      • Attacking WEP
      • Attacking WPA/WPA2
    • Mobile Devices
    • Network Security Evasion
    • Privileges Escalation
    • Maintain Access and Hide Malicious Activity
      • Backdooring
    • Cover your Tracks
  • Internet of Things
    • IoT in general
    • Common IoT Protocols
      • CoAP
      • MQTT
      • ZIGBEE
      • Bluetooth
    • Scapy
      • Sniffing and spoofing
      • ARP cache Poisoning
  • Projects
    • Cybersecurity Roadshow
Powered by GitBook
On this page
  • Dirb
  • DirBuster
  • Gobuster
  • Dirsearch
  1. Red Team
  2. Web Hacking

Directory Enumeration

These tools are used to identify hidden web server resources, which can be crucial for both security assessments and website management tasks.

PreviousWeb Server FootprintingNextSession Hijacking

Last updated 1 year ago

Dirb

Purpose: Dirb is a web application directory brute-forcing tool. It is designed to find hidden directories and files on a web server by making HTTP requests with a list of common or custom directory and file names.

Features:

  • Supports both GET and HEAD requests.

  • Allows the use of custom wordlists for directory and file enumeration.

  • Provides a simple command-line interface for ease of use.

DirBuster

Purpose: Dirbuster is another directory and file brute-forcing tool used in web application security testing. It helps identify web server content that might not be easily discoverable through standard navigation.

Features:

  • Offers a graphical user interface (GUI) for ease of use.

  • Supports dictionary-based and custom wordlists.

  • Provides multiple scanning modes and options.

  • Allows you to specify file extensions to target.

  • Generates comprehensive reports of findings.

Gobuster

Purpose: Gobuster is a directory and file brute-forcing tool that is commonly used in penetration testing. It's known for its speed and efficiency in revealing hidden web server content.

Features:

  • Performs highly parallelized scans, making it fast and efficient.

  • Supports both directory and file brute-forcing.

  • Allows you to specify extensions to target.

  • Can be configured for recursive or non-recursive scanning.

  • Supports custom wordlists for enumeration.

Default command: gobuster dir -u <Target Website> -w <PATH/TO/WORDLST>

Dirsearch

python3 dirsearch.py -e php,html,js -u https://<target> -w </path/to/wordlist>

Note: -e php,html,js specifies the file extensions to search for within directories. In this case, it's looking for directories containing PHP, HTML, and JavaScript files.

is a versatile highly configurable open-source tool for web application directory brute-forcing and scanning.

Link
Link
Link
Dirsearch.py