• An advanced web path brute-forcer

Simple Usage#

# Most basic search
python3 dirsearch.py -u https://target

# Search for specific extensions
python3 dirsearch.py -e php,html,js -u https://target

# Search with custom wordlist
python3 dirsearch.py -e php,html,js -u https://target -w /path/to/wordlist

Recursion#

  • Recursive brute-force is brute-forcing continuously the after of found directories
  • For example, if dirsearch finds admin/, it will brute-force admin/* (* is where it brute forces).
  • To enable this feature, use -r (or –recursive) flag
python3 dirsearch.py -e php,html,js -u https://target -r
  • You can set the max recursion depth with --max-recursion-depth, and status codes to recurse with --recursion-status
python3 dirsearch.py -e php,html,js -u https://target -r --max-recursion-depth 3 --recursion-status 200-399
  • If there are sub-directories that you do not want to brute-force recursively, use –exclude-subdirs
python3 dirsearch.py -e php,html,js -u https://target -r --exclude-subdirs image/,media/,css/

Threads and Asynchronus#

  • The thread number (-t | –threads) reflects the number of separated brute force processes. And so the bigger the thread number is, the faster dirsearch runs.
  • By default, the number of threads is 25, but you can increase it if you want to speed up the progress.
  • You can switch to asynchronous mode by --async, let dirsearch use coroutines instead of threads to handle concurrent requests.
python3 dirsearch.py -e php,htm,js,bak,zip,tgz,txt -u https://target -t 20 --async

Prefixes / Suffixes#

  • --prefixes: Add custom prefixes to all entries
  • --suffixes: Add custom suffixes to all entries
# testing prefixes
python3 dirsearch.py -e php -u https://target --prefixes .,admin,_ -w /path/to/wordlist
# if we pass the wordlist containing `tools` word, then results might looks like
tools
.tools
admintools
_tools

# testing suffixes
python3 dirsearch.py -e php -u https://target --suffixes ~ -w /path/to/wordlist
# if we pass the wordlist containing `internal` word, then results might looks like
internal
internal~

Filters#

  • Use -i | --include-status and -x | --exclude-status to select allowed and not allowed response status-codes
# filtering with response size
python3 dirsearch.py -e php,html,js -u https://target --exclude-sizes 1B,243KB

# filtering with text in repsonse
python3 dirsearch.py -e php,html,js -u https://target --exclude-texts "403 Forbidden"

python3 dirsearch.py -e php,html,js -u https://target --exclude-regexps "^Error$"

# Excluding redirects to auth servers
python3 dirsearch.py -e php,html,js -u https://target --exclude-redirects "https://(.*).okta.com/*"

python3 dirsearch.py -e php,html,js -u https://target --exclude-response /error.html

Exclude extensions#

  • Use -X | --exclude-extensions with an extension list will remove all paths in the wordlist that contains the given extensions
python3 dirsearch.py -u https://target -X jsp

# Wordlist:
# admin.php
# test.jsp

# Resutls:
# admin.php

Scan sub-directories#

  • From an URL, you can scan a list of sub-directories with –subdirs.
python3 dirsearch.py -e php,html,js -u https://target --subdirs /,admin/,folder/

Proxies#

  • dirsearch supports SOCKS and HTTP proxy, with two options: a proxy server or a list of proxy servers.
python3 dirsearch.py -e php,html,js -u https://target --proxy 127.0.0.1:8080
python3 dirsearch.py -e php,html,js -u https://target --proxy socks5://10.10.0.1:8080
python3 dirsearch.py -e php,html,js -u https://target --proxylist proxyservers.txt

Reports#

  • Supported report formats: simple, plain, json, xml, md, csv, html, sqlite, mysql, postgresql
python3 dirsearch.py -e php -l URLs.txt --format plain -o report.txt
python3 dirsearch.py -e php -u https://target --format html -o target.json

More example commands#


cat urls.txt | python3 dirsearch.py --stdin

python3 dirsearch.py -u https://target --max-time 360

python3 dirsearch.py -u https://target --auth admin:pass --auth-type basic

python3 dirsearch.py -u https://target --header-list rate-limit-bypasses.txt