← retour aux outils back to tools

# dirbuster

Brute-forceur de répertoires et fichiers d'applications web basé sur Java, avec une GUI. Trouve du contenu web caché à l'aide de wordlists. Le dir buster original de l'OWASP, largement supplanté par ffuf et feroxbuster. Java-based web application directory and file brute-forcer with a GUI. Finds hidden web content using wordlists. OWASP's original dir buster — largely superseded by ffuf and feroxbuster.

↗ https://github.com/KajanM/DirBuster

## Overview

DirBuster is OWASP’s original graphical directory brute-forcing tool. It discovers hidden files and directories on web servers using wordlists. While largely superseded by faster CLI tools (ffuf, feroxbuster, gobuster), DirBuster is still encountered in older tutorials and has a useful GUI for beginners.

## Basic Usage

Launch DirBuster GUI

    dirbuster

Or from CLI (headless mode)

    java -jar DirBuster-1.0-RC1.jar \
      -u http://target.com/ \
      -l /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt \
      -t 10

With extensions

    java -jar DirBuster-1.0-RC1.jar \
      -u http://target.com/ \
      -l wordlist.txt \
      -e php,html,txt \
      -t 20

## GUI Configuration

    Target URL: http://target.com/
    Work Method: GET (or POST)
    Threads: 10-20
    File with list: /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
    File extensions: php,html,asp,aspx,txt,bak
    Request method: GET

## Wordlists (Built-in)

DirBuster wordlists in Kali:

    ls /usr/share/dirbuster/wordlists/

    # directory-list-2.3-small.txt    — Quick scan
    # directory-list-2.3-medium.txt   — Standard scan
    # directory-list-2.3-big.txt      — Comprehensive scan
    # directory-list-lowercase-2.3-medium.txt  — Lowercase only

## Modern Alternatives (Recommended)

ffuf (fastest, recommended)

    ffuf -w /usr/share/wordlists/dirb/common.txt -u http://target.com/FUZZ

feroxbuster (recursive, good default)

    feroxbuster -u http://target.com -w wordlist.txt

gobuster (simple, fast)

    gobuster dir -u http://target.com -w wordlist.txt

    # All are faster and more feature-rich than DirBuster

## Tips

- DirBuster’s main advantage is the GUI — useful for new learners
- For any serious work, use ffuf or feroxbuster instead (10x+ faster)
- The “Start the scanner in pure bruteforce mode” option generates all combinations — very slow, rarely useful
- DirBuster includes good built-in wordlists that are also used by modern tools

CLI Options

    java -jar DirBuster.jar [options]

    -u URL        Target URL
    -l FILE       Wordlist file
    -e EXT        Extensions (comma-separated)
    -t THREADS    Thread count
    -s            Scan subdirectories
    -r            Parse HTML for new paths
    -o FILE       Output report file
    -H HEADER     Add header
    -c COOKIE     Cookie header
    -a AGENT      User agent
    -P USER:PASS  HTTP Basic Auth
    -x PROXY      Proxy (host:port)

## Vue d’ensemble

DirBuster est l’outil graphique original de brute-force de répertoires de l’OWASP. Il découvre les fichiers et répertoires cachés sur les serveurs web à l’aide de wordlists. Bien que largement supplanté par des outils CLI plus rapides (ffuf, feroxbuster, gobuster), DirBuster se rencontre encore dans d’anciens tutoriels et possède une GUI utile pour les débutants.

## Utilisation de base

    # Lancer la GUI DirBuster
    dirbuster

    # Ou depuis la CLI (mode sans interface)
    java -jar DirBuster-1.0-RC1.jar \
      -u http://target.com/ \
      -l /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt \
      -t 10

    # Avec des extensions
    java -jar DirBuster-1.0-RC1.jar \
      -u http://target.com/ \
      -l wordlist.txt \
      -e php,html,txt \
      -t 20

## Configuration de la GUI

    Target URL: http://target.com/
    Work Method: GET (or POST)
    Threads: 10-20
    File with list: /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
    File extensions: php,html,asp,aspx,txt,bak
    Request method: GET

## Wordlists (intégrées)

    # Wordlists DirBuster dans Kali :
    ls /usr/share/dirbuster/wordlists/

    # directory-list-2.3-small.txt    : scan rapide
    # directory-list-2.3-medium.txt   : scan standard
    # directory-list-2.3-big.txt      : scan exhaustif
    # directory-list-lowercase-2.3-medium.txt  : minuscules uniquement

## Alternatives modernes (recommandées)

    # ffuf (le plus rapide, recommandé)
    ffuf -w /usr/share/wordlists/dirb/common.txt -u http://target.com/FUZZ

    # feroxbuster (récursif, bon par défaut)
    feroxbuster -u http://target.com -w wordlist.txt

    # gobuster (simple, rapide)
    gobuster dir -u http://target.com -w wordlist.txt

    # Tous sont plus rapides et plus riches en fonctionnalités que DirBuster

## Conseils

- Le principal atout de DirBuster est la GUI : utile pour les débutants
- Pour tout travail sérieux, utilisez plutôt ffuf ou feroxbuster (10x+ plus rapides)
- L’option “Start the scanner in pure bruteforce mode” génère toutes les combinaisons : très lent, rarement utile
- DirBuster inclut de bonnes wordlists intégrées, également utilisées par les outils modernes

Options CLI

    java -jar DirBuster.jar [options]

    -u URL        Target URL
    -l FILE       Wordlist file
    -e EXT        Extensions (comma-separated)
    -t THREADS    Thread count
    -s            Scan subdirectories
    -r            Parse HTML for new paths
    -o FILE       Output report file
    -H HEADER     Add header
    -c COOKIE     Cookie header
    -a AGENT      User agent
    -P USER:PASS  HTTP Basic Auth
    -x PROXY      Proxy (host:port)