DIRSEARCH(1)

📦 version 0.4.4, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 DIRSEARCH(1) 💖

okay bestie, sit down, hydrate, and let me tell you about dirsearch — she's an advanced command-line tool designed to brute force directories and files in webservers. that's it. that's the girl. she's giving main character energy and she is coming for your hidden paths ✨

🎀 NAME 🎀

dirsearch — an advanced command-line tool designed to brute force directories and files in webservers. no cap, that's literally what she does and she does it beautifully 💅

🌸 SYNOPSIS 🌸

dirsearch.py [-u|--url] target [-e|--extensions] extensions [options]

that's the whole vibe right there. give her a target, maybe some extensions, and she goes 🦋

✨ OPTIONS ✨

💜 the basics first

  • --version — show program's version number and exit. she'll tell you who she is and then dip 👋
  • -h, --help — show this help message and exit. the classic "wait what do i do" button 🫶

👑 Mandatory:

okay so these ones are lowkey the whole point. you need a target, bestie.

  • -u URL, --url=URL — Target URL 🎯
  • -l FILE, --url-list=FILE — Target URL list file. a whole file of targets?? yes, she's ambitious 📋
  • --stdin — Target URL list from STDIN. pipe it in, we love a flexible queen 🌈
  • --cidr=CIDR — Target CIDR. network ranges, she's doing the most (respectfully) 🌐
  • --raw=FILE — Load raw HTTP request from file (use --scheme flag to set the scheme). fyi you gotta pair her with --scheme, don't forget or it's giving chaos 💀
  • -e EXTENSIONS, --extensions=EXTENSIONS — Extension list separated by commas (Example: php,asp) 🍓
  • -X EXTENSIONS, --exclude-extensions=EXTENSIONS — Exclude extension list separated by commas (Example: asp,jsp) 🚫
  • -f, --force-extensions — Add extensions to every wordlist entry. By default dirsearch only replaces the %EXT% keyword with extensions. so yeah, -f is the "no thoughts, just extensions everywhere" mode ✨

📚 Dictionary Settings:

this is where she plays dress-up with your wordlist 💅

  • -w WORDLIST, --wordlists=WORDLIST — Customize wordlists (separated by commas) 📖
  • --prefixes=PREFIXES — Add custom prefixes to all wordlist entries (separated by commas) 🎀
  • --suffixes=SUFFIXES — Add custom suffixes to all wordlist entries, ignore directories (separated by commas) 🎀
  • --only-selected — Remove paths have different extensions from selected ones via -e (keep entries don't have extensions) ✂️
  • --remove-extensions — Remove extensions in all paths (Example: admin.php -> admin) 🧚
  • -U, --uppercase — Uppercase wordlist. LOUD MODE 🔥
  • -L, --lowercase — Lowercase wordlist. soft mode 🌸
  • -C, --capital — Capital wordlist. Title Case Bestie Mode 👑

⚙️ General Settings:

the knobs and dials, the whole control room ✨

  • -t THREADS, --threads=THREADS — Number of threads. more threads = more zoomies 🏃‍♀️💨
  • -r, --recursive — Brute-force recursively. she goes deeper. that's the tweet 🌀
  • --deep-recursive — Perform recursive scan on every directory depth (Example: api/users -> api/) 🕳️
  • --force-recursive — Do recursive brute-force for every found path, not only paths end with slash 💪
  • -R DEPTH, --recursion-depth=DEPTH — Maximum recursion depth. set a limit or she'll spiral (relatable) 😭
  • --recursion-status=CODES — Valid status codes to perform recursive scan, support ranges (separated by commas) 📊
  • --subdirs=SUBDIRS — Scan sub-directories of the given URL[s] (separated by commas) 🗂️
  • --exclude-subdirs=SUBDIRS — Exclude the following subdirectories during recursive scan (separated by commas) 🚫
  • -i CODES, --include-status=CODES — Include status codes, separated by commas, support ranges (Example: 200,300-399) ✅
  • -x CODES, --exclude-status=CODES — Exclude status codes, separated by commas, support ranges (Example: 301,500-599) ❌
  • --exclude-sizes=SIZES — Exclude responses by sizes, separated by commas (Example: 123B,4KB) 📏
  • --exclude-texts=TEXTS — Exclude responses by texts, separated by commas (Example: 'Not found', 'Error') 📝
  • --exclude-regexps=REGEXPS — Exclude responses by regexps, separated by commas (Example: 'Not foun[a-z]{1}', '^Error$') 🧠
  • --exclude-redirects=REGEXPS — Exclude responses by redirect regexps or texts, separated by commas (Example: 'https://okta.com/*') 🔀
  • --exclude-response=PATH — Exclude responses by response of this page (path as input) 🪞
  • --skip-on-status=CODES — Skip target whenever hit one of these status codes, separated by commas, support ranges ⏭️
  • --minimal=LENGTH — Minimal response length 📉
  • --maximal=LENGTH — Maximal response length 📈
  • --max-time=SECONDS — Maximal runtime for the scan. a lil timer, we love boundaries ⏰
  • -q, --quiet-mode — Quiet mode. she's shy (she is not) 🤫
  • --full-url — Full URLs in the output (enabled automatically in quiet mode) 🔗
  • --no-color — No colored output. for the monochrome minimalists 🖤

🌐 Request Settings:

how she knocks on the door 🚪

  • -m METHOD, --http-method=METHOD — HTTP method (default: GET) 🛠️
  • -d DATA, --data=DATA — HTTP request data 📦
  • -H HEADERS, --header=HEADERS — HTTP request header, support multiple flags (Example: -H 'Referer: example.com') 📨
  • --header-list=FILE — File contains HTTP request headers 📄
  • -F, --follow-redirects — Follow HTTP redirects 🧭
  • --random-agent — Choose a random User-Agent for each request. she's in disguise, nobody knows her 🥸
  • --auth-type=TYPE — Authentication type (basic, digest, bearer, ntlm) 🔐
  • --auth=CREDENTIAL — Authentication credential (user:password or bearer token) 🗝️
  • --user-agent=USERAGENT — (no description given, she just lets you set your own vibe) 🦋
  • --cookie=COOKIE — (no description given either, but you know what a cookie is bestie) 🍪

🔌 Connection Settings:

the plumbing. the infrastructure. the ✨network✨ 🫶

  • --timeout=TIMEOUT — Connection timeout ⏳
  • -s DELAY, --delay=DELAY — Delay between requests. breathe, girl 🧘‍♀️
  • --proxy=PROXY — Proxy URL, support HTTP and SOCKS proxies (Example: localhost:8080, socks5://localhost:8088) 🎭
  • --proxy-list=FILE — File contains proxy servers 📁
  • --replay-proxy=PROXY — Proxy to replay with found paths 🔁
  • --scheme=SCHEME — Default scheme (for raw request or if there is no scheme in the URL) 🧬
  • --max-rate=RATE — Max requests per second 🚦
  • --retries=RETRIES — Number of retries for failed requests 🔄
  • -b, --request-by-hostname — By default dirsearch requests by IP for speed. This will force dirsearch to request by hostname 🏷️
  • --ip=IP — Server IP address 📍
  • --exit-on-error — Exit whenever an error occurs. dramatic exit, love that for her 🚪💨

📊 Reports:

receipts, bestie. always keep the receipts 🧾

  • -o FILE, --output=FILE — Output file 💾
  • --format=FORMAT — Report format (Available: simple, plain, json, xml, md, csv, html) 🎨

You can change the dirsearch default configurations (default extensions, timeout, wordlist location, ...) by editing the "/etc/dirsearch/default.conf" file. More information at https://github.com/maurosoria/dirsearch.

so yeah, if you wanna make her act different by default, that's the file to go touch. and if you want the full lore, that github link is right there 💖

👀 SEE ALSO 👀

The full documentation for dirsearch is maintained as a Texinfo manual. If the info and dirsearch programs are properly installed at your site, the command

info dirsearch

should give you access to the complete manual.

iykyk — that's your one-stop shop for the full manual, no cap 📖✨

and that's the whole page, bestie. this was dirsearch v0.4.2, brought to you from September 2021 — an icon, a legend, and she is the moment 👑💅🦋

📦 where this page comes from