> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/web-discovery/dirbuster.md).

# Dirbuster

**DirBuster** is a multi threaded java application designed to brute force directories and files names on web/application servers. Often is the case now of what looks like a web server in a state of default installation is actually not, and has pages and applications hidden within. DirBuster attempts to find these.

## Directory/file enumeration <a href="#directory-file-enumeration-mode" id="directory-file-enumeration-mode"></a>

Run `dirbuster` in headless mode (no gui) to scan for directories and files with extensions (html, php and txt)

```bash
dirbuster -H -l /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -e html,php,txt -u http://10.10.236.92
```

The report will be save as `DirBuster-Report-[hostname]-[port].txt` in the current directory by default.

## Usage information

<details>

<summary>dirbuster -h</summary>

```
┌──(kali㉿kali)-[/mnt/…/TryHackMe/CTFs/Easy/ToolsRus]
└─$ dirbuster -h
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
DirBuster - 1.0-RC1
Usage: java -jar DirBuster-1.0-RC1 -u <URL http://example.com/> [Options]

        Options:
         -h : Display this help message
         -H : Start DirBuster in headless mode (no gui), report will be auto saved on exit
         -l <Word list to use> : The Word list to use for the list based brute force. Default: /mnt/hgfs/Wargames/TryHackMe/CTFs/Easy/ToolsRus/directory-list-2.3-small.txt
         -g : Only use GET requests. Default Not Set
         -e <File Extention list> : File Extention list eg asp,aspx. Default: php
         -t <Number of Threads> : Number of connection threads to use. Default: 10
         -s <Start point> : Start point of the scan. Default: /
         -v : Verbose output, Default: Not set
         -P : Don't Parse html, Default: Not Set
         -R : Don't be recursive, Default: Not Set
         -r <location> : File to save report to. Default: /mnt/hgfs/Wargames/TryHackMe/CTFs/Easy/ToolsRus/DirBuster-Report-[hostname]-[port].txt

```

</details>

## Resources

Dirbuster - Homepage: <https://wiki.owasp.org/index.php/Category:OWASP_DirBuster_Project>

Dirbuster - Kali Tools: <https://www.kali.org/tools/dirbuster/>