Dir Buster is a robust tool for web application security testing that detects hidden directories and files on web servers. It uses a brute-force strategy, making queries to the server with a list of common directory and file names, which assists security professionals in identifying potential vulnerabilities.
What is Dir Buster
Dir Buster is a Kali application that brute-forces web and application servers. The utility can brute-force folders and files. To speed things up, the application allows users to employ multi-thread functionality. In this article, we will provide an overview of the tool and its main features.
Default Mode
We launch Dir Buster and only enter http://testphp.vulnweb.com/ into the target URL field. Keep the remainder of the options as is. Dir Buster will now automatically transition between HEAD and GET requests to launch a list-based brute force assault.
Let’s start. Dir Buster gets to work and begins brute forcing, and we see numerous files and folders appear in the results box.
GET Request Method
We’ll now configure Dir Buster to exclusively use the GET request method. To help things go a little faster, the thread count is increased to 200 and the “Go Faster” checkbox is enabled.
The Results – Tree View displays the findings.
Pure Brute Force (Numeric)
DirBuo step provides a lot of control over the attack process; in our set, we will only use numerals to do a brute force attack. This is accomplished by selecting “Pure Brute Force” in the scanning type option and “0-9” in the charset drop-down menu. By default, the minimum and maximum character limits are established.
The Results – Tree View displays the findings.
Single Sweep (Non-recursive)
We will now utilize a single sweep brute force, with each dictionary term applied only once. To accomplish this, we’ll uncheck the “Be Recursive” checkbox.
The Results – List View displays the findings.
Targeted Start
Further investigating Dir Buster’s control options, we’ll configure it to start looking in the “admin” directory. Type “/admin” into the “Dir to Start With” section and press the Start button.
The Results – Tree View displays the findings.
Blank Extensions
Dir Buster can also check into folders with a blank extension, which may reveal data that would otherwise be kept undiscovered. We simply select the “Use Blank Extension” checkbox.
We can observe the processing and DirBuster searching for directories with blank extensions.
Search by File Type (.txt)
We will change the file extension type to.txt, which will cause DirBuster to hunt only for files with that extension. Enter “.txt” in the File extension area and press Start.
We can see the processing happen and Dir Buster testing to find directories with a .txt extension.
Changing the DIR List
We will now change the directory list in DirBuster. Options > Advanced Options > DirBuster Options > Use the specified directory list. We may visit and edit the list to “directory-list-2.3-medium.txt” in Kali, which is located in /usr/share/dirbuster/wordlists.
We can see the word list is now set.
Following RedirectsDirBuster by default is not set to follow redirects during the attack, but we can enable this option under Options > Follow Redirect
