<img src="static/logo.png#gh-light-mode-only" alt="dirsearch logo (light)" width="675px"> <img src="static/logo-dark.png#gh-dark-mode-only" alt="dirsearch logo (dark)" width="675px">

dirsearch - Web path discovery

An advanced web path brute-forcer

dirsearch is being actively developed by @maurosoria and @shelld3v

Reach to our Discord server to communicate with the team at best

Table of Contents

• Supported Platforms
• Installation & Usage
• Standalone Binaries
• Wordlists
• Options
• Configuration
• How to use
• Session Management
• Support Docker
• Building from Source
• CI/CD & GitHub Workflows
• References
• Tips
• Contribution
• License

Supported Platforms

dirsearch runs on multiple platforms and can be used either via Python or standalone binaries:

| Platform | Python | Standalone Binary | |----------|--------|-------------------| | Linux (x86_64) | Python 3.9+ | dirsearch-linux-amd64 | | Windows (x64) | Python 3.9+ | dirsearch-windows-x64.exe | | macOS (Intel) | Python 3.9+ | dirsearch-macos-intel | | macOS (Apple Silicon) | Python 3.9+ | dirsearch-macos-silicon |

Standalone binaries are self-contained executables that don't require Python installation.

Installation & Usage

Requirement: python 3.9 or higher

Choose one of these installation options:

• Install with git: git clone https://github.com/maurosoria/dirsearch.git --depth 1 (RECOMMENDED)
• Install with ZIP file: Download here
• Install with Docker: docker build -t "dirsearch:v0.4.3" . (more information can be found here)
• Install with PyPi: pip3 install dirsearch or pip install dirsearch
• Install with Kali Linux: sudo apt-get install dirsearch (deprecated)

Standalone Binaries

Pre-built standalone binaries are available for all major platforms. These don't require Python to be installed.

Download from Releases

| Platform | Binary Name | Architecture | |----------|-------------|--------------| | Linux | dirsearch-linux-amd64 | x86_64 | | Windows | dirsearch-windows-x64.exe | x64 | | macOS Intel | dirsearch-macos-intel | x86_64 | | macOS Apple Silicon | dirsearch-macos-silicon | ARM64 |

Usage:

# Linux/macOS - make executable first
chmod +x dirsearch-linux-amd64
./dirsearch-linux-amd64 -u https://target

# Windows
dirsearch-windows-x64.exe -u https://target

Note: Standalone binaries include bundled db/ wordlists and config.ini. Session files are stored in $HOME/.dirsearch/sessions/ when using bundled builds.

Wordlists (IMPORTANT)

Summary:

• Wordlist is a text file, each line is a path.
• About extensions, unlike other tools, dirsearch only replaces the %EXT% keyword with extensions from -e flag.
• For wordlists without %EXT% (like SecLists), -f | --force-extensions switch is required to append extensions to every word in wordlist, as well as the /.
• To apply your extensions to wordlist entries that have extensions already, use -O | --overwrite-extensions (Note: some extensions are excluded from being overwritted such as .log, .json, .xml, ... or media extensions like .jpg, .png)
• To use multiple wordlists, you can separate your wordlists with commas. Example: wordlist1.txt,wordlist2.txt.
• Bundled wordlist categories live in db/categories/ and can be selected with --wordlist-categories. Available: extensions, conf, vcs, backups, db, logs, keys, web, common (use all to include everything).

<details> <summary><strong>Wordlist Examples (click to expand)</strong></summary>

Examples:

• Normal extensions:

index.%EXT%

Passing asp and aspx as extensions will generate the following dictionary:

index
index.asp
index.aspx

• Force extensions:

admin

Passing php and html as extensions with -f/--force-extensions flag will generate the following dictionary:

admin
admin.php
admin.html
admin/

• Overwrite extensions:

login.html

Passing jsp and jspa as extensions with -O/--overwrite-extensions flag will generate the following dictionary:

login.html
login.jsp
login.jspa

</details>

Options

<details> <summary><strong>Full Options List (click to expand)</strong></summary>

Usage: dirsearch.py [-u|--url] target [-e|--extensions] extensions [options]

Options:
  --version             show program's version number and exit
  -h, --help            show this help message and exit

  Mandatory:
    -u URL, --url=URL   Target URL(s), can use multiple flags
    -l PATH, --urls-file=PATH
                        URL list file
    --stdin             Read URL(s) from STDIN
    --cidr=CIDR         Target CIDR
    --raw=PATH          Load raw HTTP request from file (use '--scheme' flag
                        to set the scheme)
    --nmap-report=PATH  Load targets from nmap report (Ensure the inclusion of
                        the -sV flag during nmap scan for comprehensive
                        results)
    -s SESSION_FILE, --session=SESSION_FILE
                        Session file
                        Note: legacy .pickle/.pkl sessions are no longer supported.
    --config=PATH       Path to configuration file (Default:
                        'DIRSEARCH_CONFIG' environment variable, otherwise
                        'config.ini')

  Dictionary Settings:
    -w WORDLISTS, --wordlists=WORDLISTS
                        Wordlist files or directories contain wordlists
                        (separated by commas)
    --wordlist-categories=CATEGORIES
                        Comma-separated wordlist category names (e.g.
                        common,conf,web). Use 'all' to include all bundled
                        categories
    -e EXTENSIONS, --extensions=EXTENSIONS
                        Extension list separated by commas (e.g. php,asp)
    -f, --force-extensions
                        Add extensions to the end of every wordlist entry. By
                        default dirsearch only replaces the %EXT% keyword with
                        extensions
    -O, --overwrite-extensions
                        Overwrite other extensions in the wordlist with your
                        extensions (selected via `-e`)
    --exclude-extensions=EXTENSIONS
                        Exclude extension list separated by commas (e.g.
                        asp,jsp)
    --remove-extensions
                        Remove extensions in all paths (e.g. admin.php ->
                        admin)
    --prefixes=PREFIXES
                        Add custom prefixes to all wordlist entries (separated
                        by commas)
    --suffixes=SUFFIXES
                        Add custom suffixes to all wordlist entries, ignore
                        directories (separated by commas)
    -U, --uppercase     Uppercase wordlist
    -L, --lowercase     Lowercase wordlist
    -C, --capital       Capital wordlist

  General Settings:
    -t THREADS, --threads=THREADS
                        Number of threads
    --list-sessions     List resumable sessions and exit
    --sessions-dir=PATH Directory to search for resumable sessions (default:
                        dirsearch path /sessions, or $HOME/.dirsearch/sessions
                        when bundled)
    --async             Enable asynchronous mode
    -r, --recursive     Brute-force recursively
    --deep-recursive    Perform recursive scan on every directory depth (e.g.
                        api/users -> api/)
    --force-recursive   Do recursive brute-force for every found path, not
                        only directories
    -R DEPTH, --max-recursion-depth=DEPTH
                        Maximum recursion depth
    --recursion-status=CODES
                        Valid status codes to perform recursive scan, support
                        ranges (separated by commas)
    --subdirs=SUBDIRS   Scan sub-directories of the given URL[s] (separated by
                        commas)
    --exclude-subdirs=SUBDIRS
                        Exclude the following subdirectories during recursive
                        scan (separated by commas)
    -i CODES, --include-status=CODES
                        Include status codes, separated by commas, support
                        ranges (e.g. 200,300-399)
    -x CODES, --exclude-status=CODES
                        Exclude status codes, separated by commas, support
                        ranges (e.g. 301,500-599)
    --exclude-sizes=SIZES
                        Exclude responses by sizes, separated by commas (e.g.
                        0B,4KB)
    --exc