root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat dirbuster.md
// web

DirBuster

22 Jul 2026 · 2 min read
webcheatsheetsdirbuster

DirBuster (OWASP) finds hidden content on a website: directories, files, and sensitive resources the developer didn't intend to be public. It sends thousands of HTTP requests against wordlist entries, and if the response differs from a "not found", the resource exists.

TypeGUI (Java)
PlatformKali Linux (OWASP tools)
DirBuster cheat sheet

How to use it

Applications → Web Application Analysis → DirBuster
# or from the terminal:
dirbuster
  • Enter the target URL (e.g. http://192.168.1.10/)
  • Choose a mode: Wordlist (most common) or recursive (explores found subdirectories)
  • Recommended wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
  • Optional extensions: php, html, txt, bak, zip
  • Click Start

Reading the results

CodeMeaning
200 OKResource exists and is accessible
301/302Redirect
403Forbidden — exists but protected (still interesting)
/admin/     403   -> hidden panel
/backup/    200   -> possibly sensitive data
/login.php  200   -> attack point (brute force, SQLi...)
/uploads/   301

DirBuster vs Gobuster

ToolInterfaceSpeedBest for
DirBusterGUISlowLearning / detailed environment
GobusterCLIFastReal pentesting and CTFs

Gobuster is used more nowadays for speed, but DirBuster is still useful for learning the fuzzing process visually.

Tips

  • Use large wordlists (rockyou doesn't work here — it's not a path wordlist)
  • Try several extensions depending on the detected technology
  • Compare response sizes to rule out false positives
  • Combine it with Gobuster, Feroxbuster, Nikto, or Burp Suite

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.