darkdisaster08/darkbuster

★ 18PythonAudience · ops devopsComplexity · 2/5LicenseSetup · easy

Mindmap

mindmap
  root((darkbuster))
    What it does
      Directory brute-forcing
      Content discovery
      Status color coding
    Wordlists
      General paths
      Admin panels
      API endpoints
      Framework specific
    Options
      File extensions
      Custom headers
      Thread count
    Output
      Color-coded results
      Save to file

mindmap root((darkbuster)) What it does Directory brute-forcing Content discovery Status color coding Wordlists General paths Admin panels API endpoints Framework specific Options File extensions Custom headers Thread count Output Color-coded results Save to file

Click or tap to explore — scroll the page freely

Things people build with this

USE CASE 1

Find hidden admin panels and backup files on a web application during an authorized security audit.

USE CASE 2

Discover undocumented REST or GraphQL API endpoints on a target site during a bug bounty engagement.

USE CASE 3

Run an authenticated scan with a session cookie to check for access control gaps on protected pages.

Tech stack

Python

Getting it running

Difficulty · easy Time to first run · 30min

Requires Python 3.6+ on Linux, only use on systems you have explicit authorization to test.

Use freely for any purpose including commercial use, as long as you keep the copyright notice.

In plain English

DarkBuster is a Python command-line tool for web directory and file discovery, used during authorized security testing and bug bounty work. Given a target URL, it systematically requests a large number of possible paths and reports which ones return a valid HTTP response. This process, often called content discovery or directory brute-forcing, helps security researchers find hidden pages, admin panels, backup files, and API endpoints that are not linked from the main site. The tool runs multiple requests in parallel using configurable threads, which makes scanning faster on networks that can handle it. Results are color-coded by HTTP status code: green for accessible pages, yellow for redirects, red for paths that exist but return a blocked response, and blue for paths that exist but require authentication. You can save the output to a file for documentation. DarkBuster ships with a curated set of wordlists, each targeting a different type of content. The general-purpose lists cover a few hundred to a thousand common paths. Specialized lists cover admin panel login pages, REST and GraphQL API endpoints, backup files, subdomains, and specific web frameworks including WordPress, PHP, Django, Drupal, and Laravel. The author describes the wordlists as updated through May 2026, drawing on paths seen in recent bug bounty reports. Options include specifying file extensions to append to each path (so "admin" also tests "admin.php" and "admin.html"), setting a custom user-agent or cookie header for authenticated scans, adjusting the request timeout, and filtering which HTTP status codes appear in the output. The tool requires Python 3.6 or higher and is designed for Linux, including Kali Linux (a distribution commonly used for security research). It is published under the MIT license, and the README includes a disclaimer that it is intended only for authorized testing on systems the user has permission to access.

Copy-paste prompts

Prompt 1

I am doing an authorized security test on my own web app at http://localhost:8080. Help me run DarkBuster with the admin panel wordlist, appending .php and .html extensions, using 20 threads, and saving output to results.txt.

Prompt 2

I want to use DarkBuster to find undocumented API endpoints on a site I have permission to test. Which wordlist should I use and what command adds a custom Authorization header for authenticated scanning?

Prompt 3

I ran DarkBuster and got a mix of 200, 301, 403, and 401 responses. Walk me through what each color-coded result means and which ones I should investigate further in my penetration test report.

Open on GitHub → Explain another repo

← darkdisaster08 on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.