retour aux outils back to tools Ducklings

dirbuster

Brute-forceur de répertoires et fichiers d'applications web basé sur Java, avec une GUI. Trouve du contenu web caché à l'aide de wordlists. Le dir buster original de l'OWASP, largement supplanté par ffuf et feroxbuster. Java-based web application directory and file brute-forcer with a GUI. Finds hidden web content using wordlists. OWASP's original dir buster — largely superseded by ffuf and feroxbuster.

↗ https://github.com/KajanM/DirBuster

Overview

DirBuster is OWASP’s original graphical directory brute-forcing tool. It discovers hidden files and directories on web servers using wordlists. While largely superseded by faster CLI tools (ffuf, feroxbuster, gobuster), DirBuster is still encountered in older tutorials and has a useful GUI for beginners.

Basic Usage

Launch DirBuster GUI

dirbuster

Or from CLI (headless mode)

java -jar DirBuster-1.0-RC1.jar \
  -u http://target.com/ \
  -l /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt \
  -t 10

With extensions

java -jar DirBuster-1.0-RC1.jar \
  -u http://target.com/ \
  -l wordlist.txt \
  -e php,html,txt \
  -t 20

GUI Configuration

Target URL: http://target.com/
Work Method: GET (or POST)
Threads: 10-20
File with list: /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
File extensions: php,html,asp,aspx,txt,bak
Request method: GET

Wordlists (Built-in)

DirBuster wordlists in Kali:

ls /usr/share/dirbuster/wordlists/

# directory-list-2.3-small.txt    — Quick scan
# directory-list-2.3-medium.txt   — Standard scan
# directory-list-2.3-big.txt      — Comprehensive scan
# directory-list-lowercase-2.3-medium.txt  — Lowercase only

Modern Alternatives (Recommended)

ffuf (fastest, recommended)

ffuf -w /usr/share/wordlists/dirb/common.txt -u http://target.com/FUZZ

feroxbuster (recursive, good default)

feroxbuster -u http://target.com -w wordlist.txt

gobuster (simple, fast)

gobuster dir -u http://target.com -w wordlist.txt

# All are faster and more feature-rich than DirBuster

Tips

DirBuster’s main advantage is the GUI — useful for new learners
For any serious work, use ffuf or feroxbuster instead (10x+ faster)
The “Start the scanner in pure bruteforce mode” option generates all combinations — very slow, rarely useful
DirBuster includes good built-in wordlists that are also used by modern tools

CLI Options

java -jar DirBuster.jar [options]

-u URL        Target URL
-l FILE       Wordlist file
-e EXT        Extensions (comma-separated)
-t THREADS    Thread count
-s            Scan subdirectories
-r            Parse HTML for new paths
-o FILE       Output report file
-H HEADER     Add header
-c COOKIE     Cookie header
-a AGENT      User agent
-P USER:PASS  HTTP Basic Auth
-x PROXY      Proxy (host:port)

Vue d’ensemble

DirBuster est l’outil graphique original de brute-force de répertoires de l’OWASP. Il découvre les fichiers et répertoires cachés sur les serveurs web à l’aide de wordlists. Bien que largement supplanté par des outils CLI plus rapides (ffuf, feroxbuster, gobuster), DirBuster se rencontre encore dans d’anciens tutoriels et possède une GUI utile pour les débutants.

Utilisation de base

# Lancer la GUI DirBuster
dirbuster

# Ou depuis la CLI (mode sans interface)
java -jar DirBuster-1.0-RC1.jar \
  -u http://target.com/ \
  -l /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt \
  -t 10

# Avec des extensions
java -jar DirBuster-1.0-RC1.jar \
  -u http://target.com/ \
  -l wordlist.txt \
  -e php,html,txt \
  -t 20

Configuration de la GUI

Target URL: http://target.com/
Work Method: GET (or POST)
Threads: 10-20
File with list: /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
File extensions: php,html,asp,aspx,txt,bak
Request method: GET

Wordlists (intégrées)

# Wordlists DirBuster dans Kali :
ls /usr/share/dirbuster/wordlists/

# directory-list-2.3-small.txt    : scan rapide
# directory-list-2.3-medium.txt   : scan standard
# directory-list-2.3-big.txt      : scan exhaustif
# directory-list-lowercase-2.3-medium.txt  : minuscules uniquement

Alternatives modernes (recommandées)

# ffuf (le plus rapide, recommandé)
ffuf -w /usr/share/wordlists/dirb/common.txt -u http://target.com/FUZZ

# feroxbuster (récursif, bon par défaut)
feroxbuster -u http://target.com -w wordlist.txt

# gobuster (simple, rapide)
gobuster dir -u http://target.com -w wordlist.txt

# Tous sont plus rapides et plus riches en fonctionnalités que DirBuster

Conseils

Le principal atout de DirBuster est la GUI : utile pour les débutants
Pour tout travail sérieux, utilisez plutôt ffuf ou feroxbuster (10x+ plus rapides)
L’option “Start the scanner in pure bruteforce mode” génère toutes les combinaisons : très lent, rarement utile
DirBuster inclut de bonnes wordlists intégrées, également utilisées par les outils modernes

Options CLI

java -jar DirBuster.jar [options]

-u URL        Target URL
-l FILE       Wordlist file
-e EXT        Extensions (comma-separated)
-t THREADS    Thread count
-s            Scan subdirectories
-r            Parse HTML for new paths
-o FILE       Output report file
-H HEADER     Add header
-c COOKIE     Cookie header
-a AGENT      User agent
-P USER:PASS  HTTP Basic Auth
-x PROXY      Proxy (host:port)