DirBuster

DirBuster is a Java-based tool that can apply brute force in order to identify files and folders on web/application servers left behind by their developers. It contains a wide range of options and configuration settings.

The installation procedure should not take a long time to finish. The interface is made from a console frame and a graphical window that's not particularly attractive, yet easy to navigate.

DirBuster supports multiple threads and lets you select their number. After specifying the target URL to verify for files and folders, you can pick the scanning type between list-based brute force (local file chosen by the user) and pure brute force. The last option tries all combinations of characters and lets you pick the character set (uppercase and lowercase letters, numbers, symbols) along with minimum and maximum password length.

The starting point may also be selected between fuzz testing and standard mode. The latter one can apply brute force to files and directories, run in recursive mode, use blank extension, as well as take into account a starting directory and file extension.

The tool can be asked to follow redirect links, run in debug mode and parse HTML. Plus, you can create an exclusion list with file extensions, choose HTML elements to extract links from and add new tags with attributes, use HTML authentication, add new custom HTTP headers, modify the default connection timeout and limit the number of requests per second, and so on.

We have not experienced any stability issues in our tests, since DirBuster did not hang, crash or pop up error messages. It runs on low CPU and RAM, so it does not hog system resources. DirBuster features a long list of configuration settings to help users find files and folders on web/application servers.