Scanning Tool Tutorials
Dirbuster tutorial
NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
- Introduction to Dirbuster
- Installing Dirbuster
- Running Dirbuster
- Scanning for directories using Dirbuster
- Search Results using Dirbuster
dirbuster introduction
DirBuster is a tool used for discovering hidden directories and files on a web server. It does this by launching a dictionary-based attack.
dirbuster installation
apt install dirbuster
On windows, a number of sites offer the package for download. Just make sure to have the java environment installed as well. Kali Linux takes care of the dependencies. On windows, after installation, you actually need to go to the program files and find the executable in the location "C:\Program Files (x86)\DirBuster".
running dirbuster
On windows, open "Dirbuster.jar". On kali Linux you can find it on the menu or you can run the following command
dirbuster #Kali command
performing a scan in dirbuster
Once the tool is opened, you need to push in a URL in the "target URL" section. In this example I tested my own local web server so I put "http://localhost" but you try this on your own webserver or get permission to try it on the webserver for some company.
- Another important thing to check is that the number of threads will affect the speed of the scan and this will depend on speed and type of CPU on your machine. I simply use 200 threads if nothing else is running on my machine.
- On the "scan type", I prefer using the "Pure Brute Force" if I do not have any specific folders am searching for but this is much slower. You can use a "List based brute force". You simply have to pick a list to use. A list has pre-written words which are likely to be directories on a web server.
Where to find the word lists
In Kali, the list can be found in "/usr/share/dirbuster/wordlists/"
In windows, these will be in "C:\Program Files (x86)\DirBuster/"
So you can click on the browse button and select any one of these text files if you go with a list based search.
search results
The search will be producing results as it scans the directories. you can pause the search or view it differently using the tree view. Its quite an interesting tool.