dirsearch

by maurosoria

13.8Kstars

2.4Kforks

308watchers

Updated 3 months ago

About

dirsearch is an advanced Python-based web path brute-forcer designed for discovering hidden directories and files on web servers.

Web path scanner

Primary Use Case

This tool is primarily used by security professionals, penetration testers, and red teamers to identify potential attack vectors on web applications by uncovering sensitive or misconfigured directories and files. It helps in mapping the attack surface of a web application, revealing hidden administration panels, backup files, or exposed configuration settings.

Key Features

Advanced web path brute-forcing
Support for various wordlist formats
Recursive scanning capabilities
Asynchronous request handling for speed
Proxy support
Customizable filters and blacklists
Report generation
Docker support

Installation

Ensure Python 3.9 or higher is installed.
Clone the repository: `git clone https://github.com/maurosoria/dirsearch.git --depth 1`
Alternatively, download the ZIP file from the releases page.
Install via PyPi: `pip3 install dirsearch` or `pip install dirsearch`
Build Docker image: `docker build -t "dirsearch:v0.4.3" .`

Usage

>_ dirsearch -u <target_url>

Simple usage to scan a target URL.

>_ dirsearch -u <target_url> -e php,html

Scan with specific extensions.

>_ dirsearch -u <target_url> -w wordlist.txt

Use a custom wordlist.

>_ dirsearch -u <target_url> -f

Force extensions to be appended to every word in the wordlist.

>_ dirsearch -u <target_url> -r

Enable recursive scanning of sub-directories.

>_ dirsearch -u <target_url> -t 100

Set the number of threads to 100.

>_ dirsearch -u <target_url> --proxy http://127.0.0.1:8080

Use a proxy for requests.

>_ dirsearch -u <target_url> --report report.html

Generate an HTML report.

>_ dirsearch -u <target_url> --exclude-extensions .log,.json

Exclude specific file extensions from the scan.

Security Frameworks

Reconnaissance

Discovery

Initial Access

Execution

Collection

Usage Insights

Integrate dirsearch scans into CI/CD pipelines to detect exposed endpoints early in development.
Combine dirsearch with automated exploitation frameworks like Metasploit for streamlined red team workflows.
Use recursive scanning and custom wordlists to uncover deeply nested or obscure web paths.
Leverage report generation and pause/resume features to manage long-running scans efficiently during assessments.
Deploy dirsearch in containerized environments to standardize testing across teams and reduce setup complexity.