maurosoria/dirsearch
Dirsearch
dirsearch is a command-line security tool and web path scanner used for discovering hidden directories and files on web servers. It functions as a recursive directory fuzzer and brute-force utility that identifies undocumented paths and sensitive files using wordlists and HTTP status codes.
The tool distinguishes itself through template-driven path generation and an automated HTTP response filter that uses status codes, content length, and regex patterns to isolate valid targets. It supports recursive directory crawling to map complex web structures and provides state-persistence serialization to pause and resume active discovery processes.
The project covers a broad range of reconnaissance capabilities, including wordlist normalization, case transformation, and proxy routing. It provides programmatic integration via a Python library and supports exporting discovery findings into structured reports or SQL databases.
The software is distributed as a Python library and is available as containerized deployments or standalone executable binaries for cross-platform use.
Features
- Resource Discovery Brute-Forcing - Identifies hidden files and directories on web servers by iterating through predefined wordlists via HTTP requests.
- Web Directory Enumeration Tools - Discovers hidden files and directories on web servers using wordlist-based brute-force testing.
- Recursive Fuzzers - Traverses discovered subdirectories and generates paths from templates to map complex web structures.
- Endpoint Path Generators - Expands route placeholders and file extensions to create deterministic lists of potential API endpoints.
- Command Line Interfaces - Ships as a ready-to-run command-line application for automating web path discovery.
- Recursive Discovery Engines - Automatically traverses discovered links and directories to expand the investigation scope.
- Response Analysis Filters - Implements custom logic functions to analyze response bodies and content types to isolate valid targets.
- Dictionary-Based Resource Discovery - Identifies hidden files and directories using pre-defined wordlists of common paths.
- Vulnerability Research - Identifies undocumented endpoints and sensitive files to uncover security weaknesses in web servers.
- Path Generation Templates - Implements template-driven path generation to target complex API structures through route expansion.
- Reconnaissance Tools - Implements utilities for mapping and discovering the structure of web applications through active reconnaissance.
- Web Path Scanners - Functions as a specialized scanner for discovering hidden directories and files on web servers.
- Recursive Directory Traversers - Automatically initiates new discovery scans on discovered subdirectories up to a user-defined depth limit.
- Discovery Noise Filters - Classifies and excludes common error pages or false positives to reduce noise during discovery.
- HTTP Response Filters - Evaluates HTTP status codes, content lengths, and body patterns using regex to isolate valid targets from noise.
- Endpoint Discovery - Maps the structure of web applications by discovering valid URLs and API routes through automated probing.
- Payload Generators and Fuzzers - Customizes payload generation using case transformations, file extensions, and custom prefixes or suffixes.
- Python Library Wrappers - Offers an importable Python library to integrate discovery tasks directly into external code.
- File-Based Target Loading - Loads lists of target URLs from files, standard input, or CIDR ranges for systematic scanning.
- HTTP Request Customization - Enables modification of HTTP request methods, headers, and cookies to bypass server restrictions and avoid detection.
- Wordlist Generators - Organizes technology-specific paths and template-driven lists for brute-force attacks.
- Case Transformations - Provides case transformation options for wordlist entries to discover case-sensitive paths on web servers.
- Entry Filtering - Allows removing specific file extensions from target lists to isolate relevant scans.
- Normalization & Deduplication - Normalizes and deduplicates path lists from files or manual entries for organized scanning.
- Automated Security Scan Triggers - Provides programmatic interfaces to trigger automated security scans within larger discovery workflows.
- HTTP Request Templates - Allows loading raw HTTP request files to serve as templates for defining headers and methods in discovery scans.
- Request Rate Limiting - Adjusts request rates and adds custom headers to manage server interaction and avoid detection.
- State Persistence - Saves the current progress of a scan to a file to allow resuming from the last processed entry.
- Discovery Result Exporters - Saves discovery findings into structured JSON, XML, CSV, and HTML files for subsequent analysis.
- Brute Force Tools - Tool for brute forcing web directories and files.
- Content Discovery - Web path scanning utility.
- Directory Scanning Tools - Popular web path and directory scanning tool.
- Reconnaissance Tools - Scanner for discovering web paths and directories.
- Fuzzers and Brute Forcers - High-performance tool for brute-forcing directories and files on web servers.
- Network and Web Reconnaissance - Scans for hidden web paths and directories.
- Web Application Security - Automated tool for discovering hidden web server paths.
- Web Exploitation Tools - Scanner for discovering hidden web paths and directories.
- Web Reconnaissance - Web path brute-forcing tool.
