How to use the command dirbuster (with examples)

Dirbuster is a command-line tool that is used for brute forcing directories and filenames on servers. It is a useful tool for web application penetration testing and vulnerability assessment. It can help identify hidden directories and files on a web server, allowing security professionals to discover potential vulnerabilities.

Use case 1: Start in GUI mode

Code:

dirbuster -u http://example.com

Motivation: Starting Dirbuster in GUI mode is convenient for users who prefer a graphical interface. It provides a user-friendly way to interact with the tool and allows users to easily navigate through the directory and filename brute forcing process.

Explanation:

• dirbuster: The command to execute Dirbuster.
• -u http://example.com: Specifies the target URL to perform directory and filename brute forcing on.

Example output: The user interface of Dirbuster opens, and the user can start selecting options, customizing settings, and initiating the directory and filename brute forcing process.

Use case 2: Start in headless (no GUI) mode

Code:

dirbuster -H -u http://example.com

Motivation: Starting Dirbuster in headless mode is useful when working in a command-line environment, such as a remote server or when using SSH. Headless mode eliminates the need for a graphical interface and allows for automated or script-driven usage of Dirbuster.

Explanation:

• dirbuster: The command to execute Dirbuster.
• -H: Specifies the headless mode, which means no GUI will be opened.
• -u http://example.com: Specifies the target URL to perform directory and filename brute forcing on.

Example output: The command executes silently, and the directory and filename brute forcing process begins. The user can monitor the progress and see the discovered directories and files in the terminal.

Use case 3: Set the file extension list

Code:

dirbuster -e txt,html

Motivation: Setting the file extension list allows users to focus the brute forcing process on specific file types. This can be useful in scenarios where the user wants to search for specific types of files, such as text files or HTML files.

Explanation:

• dirbuster: The command to execute Dirbuster.
• -e txt,html: Sets the file extension list to search for. In this example, we specify txt and html file extensions.

Example output: Dirbuster performs the directory and filename brute forcing process, but only considers directories and files with the specified file extensions (txt and html in this case). The output shows only the discovered directories and files with the specified file extensions.

Use case 4: Enable verbose output

Code:

dirbuster -v

Motivation: Enabling verbose output provides detailed information during the brute forcing process. This can be helpful for troubleshooting, understanding the progress, and gaining insights into the discovered directories and files.

Explanation:

• dirbuster: The command to execute Dirbuster.
• -v: Enables verbose output, which provides more detailed information during the brute forcing process.

Example output: As Dirbuster performs the directory and filename brute forcing process, it displays additional information in the output. This includes the URLs being tested, the response codes, and other relevant details.

Use case 5: Set the report location

Code:

dirbuster -r path/to/report.txt

Motivation: Setting the report location allows users to define a specific path and file name for the generated report. This is helpful for organizing findings, sharing results, and documenting the discovered directories and files.

Explanation:

• dirbuster: The command to execute Dirbuster.
• -r path/to/report.txt: Specifies the location and file name of the report file. In this example, we define the path/to/report.txt.

Example output: Dirbuster performs the directory and filename brute forcing process, and at the end, it generates a report file at the specified location. The report file contains the discovered directories and files, along with additional information such as the response codes and sizes.

Conclusion:

Dirbuster is a versatile command-line tool for brute forcing directories and filenames on servers. By understanding and utilizing the various use cases provided, security professionals can effectively discover hidden directories and files that may pose security risks. Whether it’s using the GUI mode for a user-friendly experience or leveraging headless mode for automation, Dirbuster provides flexibility in performing web application penetration testing and vulnerability assessment.