maurosoria/dirsearch

dirsearch is a command-line tool that discovers hidden pages, directories, and files on websites by testing a long list of common path names against a target. The process is sometimes called web path brute-forcing: the tool systematically requests URLs like /admin, /backup, /login.php, and thousands of others to see which ones return a real response rather than a 404 error. Security researchers and bug bounty hunters use it to find parts of a website that are accessible but not publicly linked. The tool is driven by wordlists, which are plain text files where each line is a path to test. dirsearch ships with its own bundled wordlists organized into categories like common paths, configuration files, version control directories, backup files, and database files. You can also supply your own lists or combine multiple lists at once. File extension handling is flexible: you can tell the tool to append specific extensions like .php or .asp to each entry, overwrite existing extensions in the list, or test paths as-is. On the output side, dirsearch reports which paths returned successful responses, along with HTTP status codes and response sizes. Results can be saved to plain text, CSV, JSON, XML, or Markdown files. It supports continuing an interrupted scan by saving and reloading a session file. For speed and flexibility, dirsearch supports multiple concurrent requests, custom HTTP headers, proxy routing, Basic and Digest authentication, and pausing the scan on too many consecutive error responses. It can read target URLs from a file or from standard input, and accepts raw HTTP request files as an alternative to command-line flags. The tool runs on Linux, Windows, and macOS and can be installed via pip, Docker, or as a standalone binary that requires no Python installation.