Sweshi's Tutorials

Scanning Tool Tutorials


Dirbuster tutorial

NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
dirbuster introduction

DirBuster is a tool used for discovering hidden directories and files on a web server. It does this by launching a dictionary-based attack.

dirbuster installation
apt install dirbuster

On windows, a number of sites offer the package for download. Just make sure to have the java environment installed as well. Kali Linux takes care of the dependencies. On windows, after installation, you actually need to go to the program files and find the executable in the location "C:\Program Files (x86)\DirBuster".

running dirbuster

On windows, open "Dirbuster.jar". On kali Linux you can find it on the menu or you can run the following command

dirbuster #Kali command dirbuster tutorial: starting dirbuster.
performing a scan in dirbuster

Once the tool is opened, you need to push in a URL in the "target URL" section. In this example I tested my own local web server so I put "http://localhost" but you try this on your own webserver or get permission to try it on the webserver for some company.

  • Another important thing to check is that the number of threads will affect the speed of the scan and this will depend on speed and type of CPU on your machine. I simply use 200 threads if nothing else is running on my machine.
  • On the "scan type", I prefer using the "Pure Brute Force" if I do not have any specific folders am searching for but this is much slower. You can use a "List based brute force". You simply have to pick a list to use. A list has pre-written words which are likely to be directories on a web server.
dirbuster tutorial: running a scan.
Where to find the word lists

In Kali, the list can be found in "/usr/share/dirbuster/wordlists/"

dirbuster tutorial: kali wordlists.

In windows, these will be in "C:\Program Files (x86)\DirBuster/"

dirbuster tutorial: windows wordlist.

So you can click on the browse button and select any one of these text files if you go with a list based search.

search results
dirbuster tutorial:scanning.

The search will be producing results as it scans the directories. you can pause the search or view it differently using the tree view. Its quite an interesting tool.