security enabled community medium v1.0.0

dirsearch

Advanced web path and content discovery tool for brute-forcing directories and files on web servers.

📋 Live Preview

dirsearch -u {target} -w {wordlist} -t {threads}

🌍 target → url 🌍 wordlist → /usr/share/wordlists/dirb/common.txt 🌍 threads → 30

dirsearch -u {target} -w {wordlist} -t {threads}

Sandbox: execFile · Timeout: 1800s

Capabilities

web.discovery.path

web.discovery.file

web.fingerprint.directory

web.content.brute

Parameters

Name	Type	Required	Default	Description	Aliases
`url`	string	Yes	-	Target URL	`-u`, `--url`
`wordlist`	file	No	-	Path to wordlist file	`-w`, `--wordlist`
`extensions`	string	No	-	File extensions to search (comma-separated)	`-e`, `--extensions`
`threads`	integer	No	30	Number of threads (default 30)	`-t`, `--threads`
`recursive`	boolean	No	-	Enable recursive brute-force	`-r`, `--recursive`
`depth`	integer	No	-	Maximum recursion depth	`-R`, `--recursive-depth`
`exclude-status`	string	No	-	Exclude status codes (comma-separated)	`-x`, `--exclude-status`
`timeout`	integer	No	-	Request timeout in seconds	`--timeout`
`follow-redirects`	boolean	No	-	Follow HTTP redirects	`--follow-redirects`
`format`	string	No	plain	Output format: json, xml, csv, plain	`--format`
`output`	file	No	-	Output file path	`-o`, `--output`
`random-agent`	boolean	No	-	Use random User-Agent headers	`--random-agent`
`proxy`	string	No	-	Proxy URL (e.g. http://127.0.0.1:8080)	`--proxy`
`exclude_sizes`	boolean	No	-	Exclude response sizes	`--exclude-sizes`
`exclude_texts`	boolean	No	-	Exclude response texts	`--exclude-texts`
`f`	boolean	No	-	Force extensions on all words	`-f`, `--force-extensions`
`l`	boolean	No	-	URL list file	`-l`, `--url-list`
`max_response_size`	boolean	No	-	Maximum response length	`--max-response-size`
`min_response_size`	boolean	No	-	Minimum response length	`--min-response-size`

Artifacts

Type	Description	MIME	Schema	Trust
`web.discovery.results`	Discovered directories and files	application/json	-	community

Contract

Inputs

web.target.url

Target URL

file.wordlist

Wordlist for directory brute-forcing

web.file.extension

File extensions to discover

Outputs

web.discovery.results

Discovered paths and status codes

Side effects: network_traffic

Workflow Edges

Produces

web.discovery.results

Consumes

web.target.urlfile.wordlistweb.file.extension

Resource Profile

Resource	Value
CPU	medium
Memory	128 MB
Network	medium
Disk I/O	low

Examples

Basic directory scan with common wordlist

dirsearch -u https://example.com -w /usr/share/wordlists/dirb/common.txt

Scan with file extensions for web technologies

dirsearch -u https://example.com -e php,asp,html,js -t 50

Recursive scan with depth limit

dirsearch -u https://example.com -r -R 3 -t 20

Exclude 404 and 403 status codes

dirsearch -u https://example.com -x 404,403

Output results to JSON with random user-agent

dirsearch -u https://example.com --format json -o results.json --random-agent

Scan through a proxy (e.g. Burp Suite)

dirsearch -u https://example.com --proxy http://127.0.0.1:8080

Documentation

Dirsearch — Web Path Discovery

Dirsearch is an advanced command-line tool designed to brute-force directories and files in web servers. It is commonly used for content discovery and hidden resource enumeration.

Key Features

Multi-threaded: Fast scanning with configurable thread count
Recursive Scanning: Automatically discover nested directories
Extension Support: Search for specific file types (php, asp, html, etc.)
Multiple Output Formats: JSON, XML, CSV, plain text
Proxy Support: Route through Burp Suite or other intercepting proxies

Basic Usage

# Basic scan
dirsearch -u https://example.com -w /usr/share/wordlists/dirb/common.txt

# With file extensions and recursion
dirsearch -u https://example.com -e php,html -r -R 2

# Output to JSON with proxy
dirsearch -u https://example.com --format json -o results.json --proxy http://127.0.0.1:8080

Operational Security

High thread counts can cause excessive server load
Use --random-agent to avoid simple User-Agent filtering
Scanning without authorization is illegal in many jurisdictions

Dependencies

python3

Related Tools

gobusterferoxbusterffufwfuzz

References

Dirsearch GitHub