DIRB — Practical Guide

1. INTRODUCTION

Dirb is a classic web content scanner used for discovering hidden directories and files on web servers.

It works by requesting each entry from a wordlist and analyzing responses.

Useful in pentests and CTFs for locating admin panels, backups, APIs, and misconfigurations.

2. BASIC USAGE

Simple scan:

bash
dirb http://target.com

With a custom wordlist:

bash
dirb http://target.com /usr/share/wordlists/dirb/common.txt

3. SCANNING HTTPS

Use -S flag for SSL sites:

bash
dirb https://target.com -S

4. USING PROXY

Send traffic through a proxy (e.g., Burp Suite):

bash
dirb http://target.com -p http://127.0.0.1:8080

5. EXTENSION SCAN

Scan specific file extensions:

bash
dirb http://target.com -X .php,.txt,.bak

Example:

bash
dirb http://ctf.local -X .php,.html

6. IGNORING CERTIFICATE ERRORS

Ignore invalid SSL certificates:

bash
dirb https://target.com -k

7. AUTHENTICATION SUPPORT

Basic authentication:

bash
dirb http://target.com -u admin:password

Useful for targeting protected web areas.

8. BRUTE FORCE SUBDIRECTORIES

Recursive mode:

bash
dirb http://target.com -r

Be cautious — recursion can be slow and noisy.

9. FILTERING RESPONSES

Exclude certain HTTP status codes:

bash
dirb http://target.com -N 404

Useful when custom 404 pages create noise.

10. COOKIE INJECTION

Set cookie manually:

bash
dirb http://target.com -c "sessionid=abc123"

Useful for authenticated enumeration.

11. HEADER INJECTION

Add custom header:

bash
dirb http://target.com -H "User-Agent: Mozilla/5.0"

Helps bypass WAFs or fingerprinting checks.

12. INDIVIDUAL FILE WORDLISTS

Search for backup-related files:

bash
dirb http://target.com backups.txt -X .zip,.old,.bak

13. FULL PENETEST WORKFLOW EXAMPLES

Find admin panel:

bash
dirb http://target.com /usr/share/dirb/wordlists/common.txt

Search for backup archives:

bash
dirb http://target.com /usr/share/wordlists/backups.txt -X .zip,.bak,.tar

Scan API host:

bash
dirb http://api.target.com api-endpoints.txt

Use authenticated cookie for deeper discovery:

bash
dirb http://target.com -c "auth=true;role=admin"

Use proxy through Burp Suite:

bash
dirb http://target.com -p http://127.0.0.1:8080
← Back to tutorial