DirBuster on Kali: brute force directory with GUI and wordlist

DirBuster: Guide to Directory Fuzzing, Wordlist, Recursion and File Discovery #

To find hidden directories and files on a web server — /admin, /backup.zip, /config.php.bak, unlinked panels — directory brute forcing is still one of the mandatory steps in web reconnaissance. DirBuster It's the OWASP Java GUI tool, with built-in wordlists and a visual interface that displays the application structure as it scans. It's slower than modern tools, but still useful when you need visual recursion or are working on a slow target that can't handle aggressive threading.

Prerequisites: Java installed, SecLists wordlist , basic HTTP knowledge (status code, headers). Combine with Burp Suite to inspect requests during scanning.

What is DirBuster? #

DirBuster is an open-source directory and file discovery tool for web applications, written in Java and originally developed as part of the OWASP framework. It uses wordlist to locate directories, files, and resources not directly accessible from the application's links, with a GUI that displays the structure found as it progresses.

How does DirBuster work? #

Wordlist
   ↓
Ogni entry diventa una directory/file candidato
   ↓
HTTP Request al target
   ↓
HTTP Response
   ↓
Status / dimensione / contenuto della risposta
   ↓
Risorsa interessante o falso positivo

In practice, DirBuster progressively replaces each name in the wordlist at the end of the target URL, sends the request, and parses the response. With recursion enabled, it repeats the same process within each directory found.

Is DirBuster still useful in 2026? #

DirBuster hasn't been maintained for years, but it remains usable. For most modern pentesters, ffuf and feroxbuster are faster and actively developed alternatives. DirBuster remains interesting primarily for its GUI—useful for showing the tree structure to a client or when working on a slow target that can't handle aggressive threading.

DirBuster vs ffuf vs feroxbuster vs Gobuster #

DirBuster vs. ffuf: Which should you choose? For speed and everyday use, ffuf. DirBuster only makes sense if you need a GUI or want to see the recursion displayed in real time.

DirBuster vs. FeroxBuster: Which should you choose? FeroxBuster handles recursion and soft 404s better (and faster) automatically. DirBuster remains preferable on very slow targets where FeroxBuster's aggressive speed causes errors or rate limiting.

For most pentests, use ffuf or feroxbuster. Use DirBuster when: you need the GUI to display results to a client, you want to see the recursive structure visually in real time, or you're testing a very slow target where aggressive threads cause errors.

Install DirBuster on Kali Linux #

sudo apt install dirbuster -y

# Verifica
which dirbuster

It may already be present by default on Kali depending on the image/version — check with which dirbuster before taking it.

Wordlist DirBuster: Which One to Choose? #

ls /usr/share/dirbuster/wordlists/

/usr/share/dirbuster/wordlists/
├── directory-list-1.0.txt
├── directory-list-2.3-small.txt
├── directory-list-2.3-medium.txt        ← usa questa come default
├── directory-list-2.3-big.txt
├── directory-list-lowercase-2.3-small.txt
├── directory-list-lowercase-2.3-medium.txt
└── apache-user-enum-2.0.txt             (usernames via /~user/)

For a first check use a small wordlist like common.txtFor a standard assessment go to directory-list-2.3-medium.txt; for a more in-depth scan, evaluate a large wordlist, taking into account the time and load it generates on the target.

The exact number of entries per wordlist varies depending on the version of the package installed — check with wc -l on the file you're using instead of trusting a fixed number.

How to use DirBuster in GUI mode #

# Avvia DirBuster (GUI Java)
dirbuster &
# oppure
java -jar /usr/share/dirbuster/DirBuster-1.0-RC1.jar &

Configuration in GUI:

Target URL: http://target.com:80/
Work Method: GET
File Extension: php,html,txt,bak,zip,old
Wordlist: /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
☑ Be Recursive
Number of Threads: 20

Typical error: Leaving "Be Recursive" enabled with a wordlist of over a million entries on a target with many directories. The scan can take hours. Disable recursion on the first run, then manually scan the found directories.

What you read in the GUI output:

• Response 200: directory/file exists and responds — investigate
• Response 301/302: redirect — follow the redirect
• Response 403: exists but forbidden — possible bypass
• Response 404: it doesn't exist (but be careful with soft-404s, see below)

How to Use DirBuster in Headless Mode #

To use it in pipelines or on servers without X11:

# Headless mode — output su file
java -jar /usr/share/dirbuster/DirBuster-1.0-RC1.jar \
  -H \
  -u http://target.com/ \
  -l /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt \
  -e php,html,txt,bak \
  -t 20 \
  -r report.txt

# Opzioni principali:
# -H         headless (no GUI)
# -u URL     target
# -l FILE    wordlist
# -e EXT     estensioni (comma-separated)
# -t N       thread
# -r FILE    report output
# -s /       punto di partenza del path di scansione (default: /), NON una porta
# -R         disabilita la ricorsione — di default DirBuster È GIÀ ricorsivo

Dir found: /admin/ - 200
Dir found: /backup/ - 200
File found: /config.php.bak - 200
File found: /admin/login.php - 200
Dir found: /admin/includes/ - 403

How to Find Backup Files with DirBuster #

Extensions are crucial. Using the directory list alone won't find the files. Always add extensions based on the target's technology.

PHP Extensions #

php,php3,php4,php5,phtml,bak,old,txt,zip,tar.gz,conf

ASP.NET Extensions #

asp,aspx,ashx,asmx,config,bak,old,txt,zip

Java Extensions #

jsp,jspx,war,jar,xml,properties,bak,txt

Backup and configuration files (any target) #

bak,old,txt,log,zip,tar,gz,sql,conf,cfg,ini,.env,backup

# Headless con estensioni aggressive
java -jar /usr/share/dirbuster/DirBuster-1.0-RC1.jar \
  -H -u https://target.com/ \
  -l /usr/share/seclists/Discovery/Web-Content/common.txt \
  -e php,bak,old,txt,zip,sql,.env,conf \
  -t 15 -r results.txt

A file .env An exposed file may contain database credentials, API keys, tokens, or other application secrets. .sql may contain data or database structures and should be treated as potentially sensitive. .bak It's often a copy of a configuration file. It's always worth adding these extensions.

DirBuster and Soft-404: How to Avoid False Positives #

A soft 404 occurs when an application returns a seemingly valid response, often 200 OK, even for nonexistent URLs. During directory fuzzing, this produces hundreds or thousands of false positives—DirBuster shows everything as found, and becomes useless without fixing it.

How to identify it:

# Prova a richiedere un path assurdo
curl -I http://target.com/qwerasdfzxcv1234567

# Se risponde 200 con lo stesso body di sempre → soft-404
# Guarda la lunghezza della risposta: se è uguale per tutti → soft-404

Solution in DirBuster (GUI):

1. Make a manual request to a non-existent path
2. Note the length of the response (e.g. 1423 bytes)
3. In DirBuster: Options → Add a custom 404 response size
4. Enter 1423 — DirBuster excludes all responses of that size

With feroxbuster (more elegant alternative):

# feroxbuster gestisce soft-404 automaticamente
feroxbuster -u http://target.com -w /usr/share/seclists/Discovery/Web-Content/common.txt --auto-tune

How to Create a Custom Wordlist for DirBuster #

Generic wordlists lose application-specific paths. To find the actual paths, extract links from the application's JavaScript code, sitemap, and other sources.

From JavaScript #

pip install linkfinder

# Analizza un file JS
python3 linkfinder.py -i http://target.com/app.js -o cli

# Analizza tutti i JS linkati dalla homepage
python3 linkfinder.py -i http://target.com -d -o cli > js_paths.txt

# Filtra e crea wordlist
grep "/" js_paths.txt | sed 's|.*://[^/]*/||' | sort -u > custom_wordlist.txt

From sitemap.xml #

curl -s http://target.com/sitemap.xml | grep -oP 'https?://[^<]+' | \
  sed "s|http://target.com/||" | sort -u >> custom_wordlist.txt

From robots.txt #

curl -s http://target.com/robots.txt | grep -E "Disallow|Allow" | \
  awk '{print $2}' >> custom_wordlist.txt

Using the custom wordlist #

java -jar /usr/share/dirbuster/DirBuster-1.0-RC1.jar \
  -H -u http://target.com/ \
  -l custom_wordlist.txt \
  -e php,html -t 10 -r results.txt

You can further enrich the wordlist with manually discovered endpoints by browsing the application with Burp Suite active as a proxy.

How to use recursion in DirBuster #

Recursion allows DirBuster to continue scanning within each directory it finds. This is useful for mapping deep structures, but it can quickly increase the number of requests—and be careful: by default DirBuster is already recursiveThe flag -R does not activate recursion, the deactivates.

Recommended strategy:

1. First run with -R (recursion disabled) — only identifies top-level directories
2. Second run without -R (default recursion on) only on interesting directories

# Run 1: niente ricorsione, solo primo livello
java -jar DirBuster-1.0-RC1.jar \
  -H -u http://target.com/ \
  -l directory-list-2.3-small.txt \
  -t 20 -r run1.txt \
  -R
# -R qui DISATTIVA la ricorsione di default

# Analizza risultati
grep "Dir found" run1.txt | grep -v "403"
# Output: /admin/, /api/, /backup/

# Run 2: ricorsiva (comportamento di default, niente -R) solo su /admin/
java -jar DirBuster-1.0-RC1.jar \
  -H -u http://target.com/admin/ \
  -l directory-list-2.3-medium.txt \
  -e php,html,txt -t 15 -r run2_admin.txt
# Nessun -R → resta ricorsivo di default

How to Use DirBuster During a Web Pentest #

1. QUICK WIN (2 minuti)
   └─ DirBuster (o ffuf) con common.txt
   └─ Estensioni: php,html,txt,bak
   └─ 20 thread, no ricorsione

2. STANDARD SCAN (10-30 minuti)
   └─ directory-list-2.3-medium.txt
   └─ Estensioni basate su tech stack rilevato
   └─ Controlla robots.txt e sitemap.xml prima

3. CUSTOM WORDLIST
   └─ Estrai URL da JS (linkfinder)
   └─ Estrai da sitemap/robots.txt
   └─ Merge + deduplica → wordlist specifica del target

4. RICORSIONE
   └─ Analizza directory di primo livello
   └─ Ricorsione manuale su /admin/, /api/, /backup/

5. ANALISI RISULTATI
   └─ 200: apri nel browser, analizza
   └─ 403: prova bypass (X-Forwarded-For, metodo PUT/POST, path encoding)
   └─ 301: segui redirect
   └─ Soft-404: escludi per dimensione risposta

Troubleshooting #

FAQ #

What is DirBuster? An open-source Java tool, developed in the OWASP context, for finding hidden directories and files on a web server using wordlists.

Is DirBuster still useful in 2026? Yes, even though it's no longer maintained. For most pentests, ffuf and feroxbuster are faster; DirBuster remains useful for GUIs and slow targets that can't handle aggressive threading.

What is the best wordlist for DirBuster? common.txt for a quick first check, directory-list-2.3-medium.txt for a standard assessment, larger wordlists for an in-depth analysis — always evaluating time and load on the target.

Does DirBuster support HTTPS? Yes, just use https:// in the target URL. With self-signed certificates, it may give an SSL error — in that case, it's best to switch to feroxbuster with --insecure.

How do I avoid soft 404 false positives? Try a nonexistent path, note the size of the response, and exclude it in DirBuster via Options → custom 404 response size.

DirBuster vs. ffuf: Which should you choose? ffuf for speed and everyday use. DirBuster only if you need a GUI or real-time recursive viewing.

DirBuster vs. Feroxbuster: Which should you choose? Feroxbuster for automatic recursion and integrated soft-404 handling. DirBuster on very slow targets where aggressive speed causes errors.

How do I find backup files with DirBuster? Add extensions like bak,old,sql,zip,tar.gz,.env,conf upon scanning — these are the most common formats for backups and configuration files that are mistakenly exposed.

What's the difference between DirBuster and dirb? DirBuster has a GUI, dirb is a pure CLI written in C. Both are slow by current standards—for a modern CLI, choose ffuf or feroxbuster.

DirBuster Cheat Sheet #

=== AVVIO ===
GUI:        dirbuster
Headless:   java -jar DirBuster-1.0-RC1.jar -H -u URL -l WORDLIST -e EXT -t 20 -r report.txt

=== WORDLIST KALI INCLUSE ===
Quick:      /usr/share/dirbuster/wordlists/directory-list-1.0.txt
Standard:   /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt
Aggressivo: /usr/share/dirbuster/wordlists/directory-list-2.3-big.txt
SecLists:   /usr/share/seclists/Discovery/Web-Content/common.txt

=== ESTENSIONI COMUNI ===
PHP:        php,php3,bak,old,txt,zip,conf
ASP.NET:    asp,aspx,ashx,config,bak,txt,zip
Java:       jsp,war,xml,properties,bak
Generiche:  bak,old,txt,log,zip,sql,conf,.env,backup

=== SOFT-404 FIX ===
Test:       curl -I http://target.com/aaaabbbbcccc1234
Fix GUI:    Options → custom 404 response size

=== CUSTOM WORDLIST ===
JS:         python3 linkfinder.py -i http://target.com -d -o cli > paths.txt
Sitemap:    curl -s http://target.com/sitemap.xml | grep -oP 'https?://[^<]+' | sed ...
Robots:     curl -s http://target.com/robots.txt | grep Disallow

=== ALTERNATIVA RAPIDA ===
ffuf:       ffuf -w common.txt -u http://target.com/FUZZ -e .php,.bak --hc 404
feroxbuster: feroxbuster -u http://target.com -w common.txt -x php,bak --auto-tune
gobuster:   gobuster dir -u http://target.com -w common.txt -x php,bak

Related guides on hackita.it:

• wfuzz: Advanced Web Fuzzing with Encoders and Multi-Position
• Burp Suite: Intercept and Analyze HTTP Traffic
• Wordlist and SecLists: Operational Guide
• Web Application Attacks

References #

• OWASP DirBuster Project
• SecLists – Discovery Wordlists