Dirb - Web Content Scanner tool
Dirb - Web Content Scanner
Dirb is a widely-used open-source web content scanner
designed to discover existing—and often hidden—directories and files on web
servers. Its primary purpose is professional web application auditing and
security testing, helping penetration testers and security researchers map out
a website's structure to identify potential entry points, such as
administrative panels, backup files, or configuration files that aren't
publicly linked .
How It Works
The tool operates on a simple but effective principle: a
**dictionary-based attack**. It works by launching a dictionary attack against
a web server and analyzing the responses . Essentially, dirb sends HTTP
requests to the server for a list of common paths (e.g., `/admin`, `/backup`,
`/config.php`) from a wordlist file. By examining the HTTP status codes in the
server's responses, it determines whether a resource exists .
* `200 OK`: The
directory or file exists and is accessible.
* `403 Forbidden`:
The resource exists but access is restricted.
* `404 Not Found`:
The resource does not exist .
It is a staple tool in penetration testing distributions
like Kali Linux, where it is usually pre-installed . While incredibly useful,
it's crucial to use dirb only on targets you have explicit authorization to
test, as unauthorized scanning can be illegal .
Key Features and Options
Dirb offers several command-line options to customize and
refine scanning to fit different scenarios .
| Option | Example | Description |
| :--- | :--- | :--- |
| `-X` | `-X .php,.bak` | Appends specified file extensions
to each wordlist entry to find specific file types . |
| `-x` | `-x admin_` | Prepends a prefix to each wordlist
entry . |
| `-o` | `-o results.txt` | Saves the scan output to a file
for later analysis . |
| `-r`| `-r` | Disables recursive scanning, preventing it
from scanning within discovered directories . |
| `-c` | `-c "PHPSESSID=abc123"` | Sets a specific
cookie for the HTTP request, useful for scanning authenticated areas . |
| `-u` | `-u admin:password` | Provides credentials for
Basic HTTP Authentication . |
| `-H` | `-H "User-Agent: MyAgent"` | Adds a
custom header to the requests, which can help bypass security filters . |
| `-p` | `-p 127.0.0.1:8080` | Routes traffic through a
proxy, useful for hiding your IP or debugging with tools like Burp Suite . |
| `-N` | `-N 404` | Ignores responses with a specific HTTP
status code to filter out noise . |
| `-z` | `-z 100` | Adds a delay (in milliseconds) between
requests to slow down the scan and avoid overwhelming the server . |
Practical Example
The most common usage involves scanning a target with a
specified wordlist:
```bash
dirb http://testphp.vulnweb.com
/usr/share/wordlists/dirb/common.txt
```
This command uses the default common wordlist to scan the
publicly available `testphp.vulnweb.com` website. A successful scan might
produce output like:
```
+ http://testphp.vulnweb.com/admin/ (CODE:200|SIZE:1580)
+ http://testphp.vulnweb.com/config/ (CODE:200|SIZE:512)
==> DIRECTORY: http://testphp.vulnweb.com/docs/
```
This output reveals that the `/admin` and `/config`
directories exist (indicated by a `200 OK` status) and that `/docs` is a
directory, which Dirb will proceed to scan recursively if not stopped .
To scan for files with a specific extension, you could use
the `-X` flag:
```bash
dirb https://example.com -X .php
```
This command would only check for files ending in `.php`,
making the scan faster and more targeted .
Conclusion
Dirb is a foundational tool for web application security
testing. Its simplicity, combined with its efficient dictionary-based scanning,
makes it an indispensable part of any security professional's toolkit for the
crucial early stage of information gathering and reconnaissance .
Comments
Post a Comment