root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat dirb.md
// web

Dirb

21 Jul 2026 · 6 min read
webcheatsheetsdirb
DIRB is a web content scanner that discovers hidden directories and files through dictionary-based brute force. It fires HTTP requests at the target URL, testing each wordlist entry and reporting the responses that exist. It is a classic, simple and stable tool, ideal for the enumeration phase of a web audit.

The key to DIRB is understanding that the quality of its results depends entirely on the wordlist and on how it tells what exists from what does not. By default it treats anything other than a 404 as valid, so against applications that return 200 on non-existent pages you should tune detection with -N or -f. Its automatic recursion can explode the request count, something to control with -r and -z.

1. Beginner level — wordlists, extensions and output

DIRB cheat sheet — Beginner
CommandWhat it does
dirb <t>Basic scan with the default wordlist
dirb <t> <wordlist>Use a custom wordlist
dirb <t> -X .php,.txtAdd extensions to the search
dirb <t> -o out.txtSave results to a file
dirb <t> -rDisable recursive scanning
dirb <t> -SSilent mode
dirb <t> -z 10Add a delay between requests (ms)
dirb <t> -wDo not stop on warnings
dirb <t> -vAlso show not-found pages
dirb <t> -N 404Ignore a specific response code
dirb <t> -tDo not force a trailing "/" on the URL
dirb <t> -iCase-insensitive search
dirb <t> -lShow the "Location" header
dirb <t> -REnable interactive recursion

2. Advanced level — auth, proxy and evasion

DIRB cheat sheet — Advanced
CommandWhat it does
dirb <t> -H "Auth: Bearer x"Add a custom header
dirb <t> -c "PHPSESSID=x"Add cookies to the request
dirb <t> -u user:passHTTP basic authentication
dirb <t> -p proxy:8080Route requests through a proxy
dirb <t> -P user:passAuthenticate against the proxy
dirb <t> -a "Mozilla/5"Customize the User-Agent
dirb <t> -fTune NOT_FOUND detection
dirb <t> -X .bak,.old,.zipSearch typical backup extensions
dirb <t> -z 500 -wEvasion: delay + ignore warnings
dirb <t> <wl> -o out.txt -SSilent with output to a file
dirb <t> -p https://proxy:8080Proxy over HTTPS too
dirb <t> -X .php -i -rCombine extension, case-insensitive and non-recursive
dirb <t> -N 500,502,503Ignore several error codes at once
dirb <t> -c "a=1" -H "X-Fwd:127.0.0.1"Combine cookies and headers for bypass

3. Details people miss

  • DIRB only ships small wordlists; for serious results point it at dictionaries such as those in SecLists under /usr/share/wordlists instead of the default list.
  • By default it flags as "found" anything that does not return a 404. If the app answers 200 on non-existent paths (custom error pages), use -N to ignore codes or -f to fine-tune NOT_FOUND detection and avoid hundreds of false positives.
  • Recursion is on by default: DIRB descends into every directory it finds and multiplies requests. On large targets disable it with -r and add -z so you don't hammer the server or trip the WAF.
  • -X appends specific extensions (.php,.txt) and is different from -x, which reads a list of extensions from a file. Mixing them up is a common mistake.
  • DIRB is single-threaded with no concurrency, so it is noticeably slower than gobuster or ffuf. Use it when stability and simplicity matter more than speed.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.