← retour aux outils back to tools

# dirsearch

Scanner de chemins web avec wordlist intégrée et filtrage intelligent. Trouve fichiers, répertoires et endpoints cachés sur les serveurs web. Web path scanner with a built-in wordlist and smart filtering. Finds hidden files, directories, and endpoints on web servers.

↗ https://github.com/maurosoria/dirsearch

## Overview

dirsearch is a mature web path brute-forcer with built-in smart filtering, recursion, and a curated default wordlist. It’s simpler to use than ffuf for standard directory enumeration tasks, with sensible defaults out of the box.

## Basic Usage

Basic scan (uses built-in wordlist)

    dirsearch -u https://target.com

With custom wordlist

    dirsearch -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt

With file extensions

    dirsearch -u https://target.com -e php,html,txt,js,bak

Multiple extensions

    dirsearch -u https://target.com -e php,html,js,txt,xml,json,config,bak,old,zip

No extensions (directories only)

    dirsearch -u https://target.com -e ""

## Filtering

Exclude specific status codes

    dirsearch -u https://target.com --exclude-status 403,401

Only include specific status codes

    dirsearch -u https://target.com -i 200,301,302

Exclude responses containing string

    dirsearch -u https://target.com --exclude-texts "Not Found"

Exclude by response size

    dirsearch -u https://target.com --exclude-sizes 1024

Filter by regex on response body

    dirsearch -u https://target.com --exclude-regex "Access denied"

## Recursion

Recursive scan (follow found directories)

    dirsearch -u https://target.com -r

Limit recursion depth

    dirsearch -u https://target.com -r --max-recursion-depth 3

## Authentication & Proxy

HTTP basic auth

    dirsearch -u https://target.com --auth admin:password --auth-type basic

Digest auth

    dirsearch -u https://target.com --auth admin:password --auth-type digest

Cookie

    dirsearch -u https://target.com -H "Cookie: session=abc123"

Custom headers

    dirsearch -u https://target.com -H "X-Forwarded-For: 127.0.0.1" -H "Authorization: Bearer TOKEN"

Through proxy

    dirsearch -u https://target.com --proxy http://127.0.0.1:8080

## Multiple Targets

Scan multiple URLs

    dirsearch -u https://target1.com -u https://target2.com

From file

    dirsearch -l targets.txt

## Output

Save to file

    dirsearch -u https://target.com -o results.txt

JSON output

    dirsearch -u https://target.com --format json -o results.json

CSV output

    dirsearch -u https://target.com --format csv -o results.csv

Plain URL output (for piping)

    dirsearch -u https://target.com --format plain -o urls.txt

## Performance

Thread count

    dirsearch -u https://target.com -t 50

Delay between requests (seconds)

    dirsearch -u https://target.com --delay 0.5

Request timeout

    dirsearch -u https://target.com --timeout 10

## Tips

- Default wordlist (`/usr/lib/python3/dist-packages/dirsearch/db/dicc.txt`) is solid for quick scans
- Use `-e php,html` to check for backup files like `index.php.bak` or `config.html.old`
- Recursion (`-r`) can dramatically expand scan time — use `--max-recursion-depth 2` to limit it
- Compare results against ffuf with SecLists wordlists for thoroughness

Help / Man page

    dirsearch [options]

    -u URL           Target URL
    -l file          Target URL list
    -e exts          File extensions (comma-separated)
    -w wordlist      Wordlist path
    -t threads       Number of threads (default: 25)
    -r               Recursive scanning
    --max-recursion-depth N   Max recursion depth
    -i codes         Include status codes
    --exclude-status codes    Exclude status codes
    --exclude-sizes sizes     Exclude by size
    --exclude-texts strings   Exclude by content
    --proxy URL      HTTP proxy
    -H header        Custom header (repeatable)
    --auth user:pass HTTP auth
    --auth-type type basic, digest, bearer
    --timeout secs   Request timeout
    --delay secs     Delay between requests
    -o file          Output file
    --format fmt     Output format: plain, simple, json, xml, md, csv
    -q               Quiet mode
    -v               Verbose

## Vue d’ensemble

dirsearch est un brute-forceur de chemins web mature, avec filtrage intelligent intégré, récursion, et une wordlist par défaut soignée. Il est plus simple à utiliser que ffuf pour les tâches d’énumération de répertoires standard, avec des valeurs par défaut pertinentes dès l’installation.

## Utilisation de base

    # Scan de base (utilise la wordlist intégrée)
    dirsearch -u https://target.com

    # Avec une wordlist personnalisée
    dirsearch -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt

    # Avec des extensions de fichiers
    dirsearch -u https://target.com -e php,html,txt,js,bak

    # Plusieurs extensions
    dirsearch -u https://target.com -e php,html,js,txt,xml,json,config,bak,old,zip

    # Sans extension (répertoires uniquement)
    dirsearch -u https://target.com -e ""

## Filtrage

    # Exclure des codes de statut précis
    dirsearch -u https://target.com --exclude-status 403,401

    # N'inclure que des codes de statut précis
    dirsearch -u https://target.com -i 200,301,302

    # Exclure les réponses contenant une chaîne
    dirsearch -u https://target.com --exclude-texts "Not Found"

    # Exclure par taille de réponse
    dirsearch -u https://target.com --exclude-sizes 1024

    # Filtrer par regex sur le corps de la réponse
    dirsearch -u https://target.com --exclude-regex "Access denied"

## Récursion

    # Scan récursif (suivre les répertoires trouvés)
    dirsearch -u https://target.com -r

    # Limiter la profondeur de récursion
    dirsearch -u https://target.com -r --max-recursion-depth 3

## Authentification et proxy

    # HTTP basic auth
    dirsearch -u https://target.com --auth admin:password --auth-type basic

    # Digest auth
    dirsearch -u https://target.com --auth admin:password --auth-type digest

    # Cookie
    dirsearch -u https://target.com -H "Cookie: session=abc123"

    # En-têtes personnalisés
    dirsearch -u https://target.com -H "X-Forwarded-For: 127.0.0.1" -H "Authorization: Bearer TOKEN"

    # À travers un proxy
    dirsearch -u https://target.com --proxy http://127.0.0.1:8080

## Cibles multiples

    # Scanner plusieurs URLs
    dirsearch -u https://target1.com -u https://target2.com

    # Depuis un fichier
    dirsearch -l targets.txt

## Sortie

    # Sauvegarder dans un fichier
    dirsearch -u https://target.com -o results.txt

    # Sortie JSON
    dirsearch -u https://target.com --format json -o results.json

    # Sortie CSV
    dirsearch -u https://target.com --format csv -o results.csv

    # Sortie URLs brutes (pour le piping)
    dirsearch -u https://target.com --format plain -o urls.txt

## Performance

    # Nombre de threads
    dirsearch -u https://target.com -t 50

    # Délai entre les requêtes (secondes)
    dirsearch -u https://target.com --delay 0.5

    # Timeout de requête
    dirsearch -u https://target.com --timeout 10

## Conseils

- La wordlist par défaut (`/usr/lib/python3/dist-packages/dirsearch/db/dicc.txt`) est solide pour des scans rapides
- Utilisez `-e php,html` pour chercher des fichiers de sauvegarde comme `index.php.bak` ou `config.html.old`
- La récursion (`-r`) peut allonger énormément le temps de scan : utilisez `--max-recursion-depth 2` pour la limiter
- Comparez les résultats avec ffuf et les wordlists SecLists pour l’exhaustivité

Aide / Page de manuel

    dirsearch [options]

    -u URL           Target URL
    -l file          Target URL list
    -e exts          File extensions (comma-separated)
    -w wordlist      Wordlist path
    -t threads       Number of threads (default: 25)
    -r               Recursive scanning
    --max-recursion-depth N   Max recursion depth
    -i codes         Include status codes
    --exclude-status codes    Exclude status codes
    --exclude-sizes sizes     Exclude by size
    --exclude-texts strings   Exclude by content
    --proxy URL      HTTP proxy
    -H header        Custom header (repeatable)
    --auth user:pass HTTP auth
    --auth-type type basic, digest, bearer
    --timeout secs   Request timeout
    --delay secs     Delay between requests
    -o file          Output file
    --format fmt     Output format: plain, simple, json, xml, md, csv
    -q               Quiet mode
    -v               Verbose