Dirsearch
Advanced web path brute-forcer to discover hidden directories and files.
External Tool
This open-source tool is maintained externally. View the source on GitHub to learn more or run it yourself.
Browse security tools →What's next with Dirsearch?
Choose how you want to get started.
Use it free
Open the official tool or demo — no account needed.
Self-host it
Run the open-source version on your own infrastructure.
What is Dirsearch?
Dirsearch is an open-source web path brute-forcer designed to discover hidden directories and files on target servers. It automates the process of scanning URLs by systematically testing predefined wordlists against a target domain, identifying potential vulnerabilities or overlooked resources. This tool is widely used by ethical hackers, penetration testers, and security researchers to assess web application security. Its primary purpose is to streamline the manual process of guessing valid paths, which is critical in identifying misconfigurations, outdated software, or exposed administrative interfaces. By leveraging customizable wordlists and protocol-specific checks, Dirsearch addresses the challenge of efficiently mapping out a website's structure without requiring extensive manual effort. The tool's active development and large community engagement (15k+ stars) reflect its value in the cybersecurity ecosystem. It solves the problem of time-consuming manual path enumeration by automating the process, allowing users to focus on analyzing results rather than brute-forcing URLs. Dirsearch's flexibility in handling HTTP/HTTPS, FTP, and SMB protocols makes it adaptable to diverse environments. Its open-source nature and GPL-3.0 license ensure transparency and collaborative improvement, making it a trusted choice for security professionals seeking to uncover potential attack vectors.
How it works
Dirsearch is a command-line tool for enumerating web paths by brute-forcing directories and files. It systematically tests predefined wordlists against a target URL to identify valid paths, such as hidden admin panels or misconfigured resources. The tool is primarily used in penetration testing and vulnerability assessments to uncover weaknesses in web applications. Its purpose is to automate the tedious process of manual path guessing, saving time while improving the efficiency of security audits. Dirsearch supports multiple protocols (HTTP/HTTPS, FTP, SMB) and allows users to customize wordlists for specific targets. It can detect common vulnerabilities like directory traversal or exposed configuration files. For example, it can identify paths like /admin/, /backup/, or /robots.txt by testing them against the target server.
How to use it
- 1Install via pip: `pip install dirsearch` or clone the GitHub repository. 2. Run the tool with the target URL: `dirsearch -u https://example.com`. 3. Specify a wordlist using the `-w` flag, e.g., `-w /path/to/wordlist.txt`. 4. Review the output in the terminal or saved file to identify valid paths. Practical tips include using the `-e` flag to filter results by file extensions (e.g., `-e php,txt`) and the `-t` flag to adjust thread count for performance. Proxies can be configured with the `-p` option for bypassing firewalls.
What it can do
- web path discovery
Use cases
Assumptions and limitations
Assumptions
- source: https://github.com/maurosoria/dirsearch
- license: GPL-3.0 — free to use
- privacy: Self-hosted — you control your data
Limitations
- Dual-use tool — use only with explicit authorization on systems you own or have permission to test.
- Relies on existing wordlists, which may miss unique or custom paths
- Cannot bypass advanced rate-limiting or IP blocking mechanisms
- Requires manual adjustment for dynamic content or JavaScript-rendered URLs
- Limited support for complex authentication workflows without proxy integration
Understanding the result
Advanced web path brute-forcer to discover hidden directories and files.
Tool details
- Clearly flagged when a network request is needed.
- No account, no sign-up, and no tracking of your content.
- Powered by (GPL-3.0).
- Built with
- (maurosoria/dirsearch)
- License
- GPL-3.0
- Runs locally
- No — requires a network request
- Verification
- Not yet verified
- Input
- Query
- Output
- Text
Built with maurosoria/dirsearch. OpenToolVault provides the discovery and browser interface while crediting the original project maintainers.
- Built with
- License
- GPL-3.0
Open-source project
OpenToolVault is an independent directory. We are not affiliated with or endorsed by this project.
References
- / — GitHub Repository
Upstream project · GitHub
- GPL-3.0 License
Upstream project
Frequently asked
What is Dirsearch used for?
Dirsearch is used to automate the discovery of hidden directories and files on web servers. It helps security professionals identify potential vulnerabilities, such as exposed configuration files, misconfigured backups, or undocumented administrative interfaces. This tool is essential for penetration testing and vulnerability assessments, enabling users to map out a website's structure efficiently.
How does Dirsearch work technically?
Dirsearch operates by sending HTTP requests to a target URL with each entry from a wordlist. It uses brute-force techniques to guess valid paths, checking responses for HTTP status codes (e.g., 200 OK for successful requests). The tool supports multiple protocols (HTTP/HTTPS, FTP, SMB) and can filter results based on file extensions or response content. It also allows customization of headers and proxy chains for advanced scenarios.
How do I run Dirsearch with a custom wordlist?
To use a custom wordlist, run the command: `dirsearch -u https://example.com -w /path/to/wordlist.txt`. Replace `https://example.com` with your target URL and `/path/to/wordlist.txt` with the location of your wordlist file. You can also combine multiple wordlists using the `-w` flag multiple times. Ensure the wordlist contains potential path guesses (e.g., `admin`, `backup`, `config`)
How does Dirsearch compare to alternatives like ffuf or gospider?
Dirsearch focuses on brute-forcing paths with customizable wordlists, while ffuf is optimized for speed and supports fuzzing with dynamic payloads. Gospider, on the other hand, is a web spider for crawling websites. Dirsearch excels in targeted path enumeration, whereas ffuf offers broader fuzzing capabilities. Each tool has unique strengths, and the choice depends on the specific testing requirements.
How do I troubleshoot connection issues with Dirsearch?
Connection issues may arise from firewall blocks, incorrect URLs, or proxy misconfigurations. Verify the target URL is accessible via a browser. Use the `-p` flag to specify a proxy (e.g., `-p http://127.0.0.1:8080`). If the server enforces rate-limiting, reduce the thread count with `-t 1` or use a proxy to bypass restrictions. Check the tool's documentation for error codes and ensure dependencies like Python and libraries are up to date.