Ravindra BagaleCourses & study guides

21. Web Application Testing Tools

21.5 Gobuster and Dirb: Finding Hidden Content

Web servers var khup pages links madhun disat nahit – /admin, /backup, /config.php, old files. Directory brute-forcing tools ek wordlist gheun pratyek naav try kartat aani konte exist kartat te sangtat (HTTP status codes: 200 found, 301/302 redirect, 403 forbidden-but-there, 404 not found).

# Gobuster (fast, written in Go)
gobuster dir -u http://192.168.56.20 -w /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://192.168.56.20/dvwa -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,bak
gobuster dns -d lab.local -r 192.168.56.20 -w /usr/share/wordlists/subdomains-top1million-5000.txt   # subdomains

# Dirb (classic, simple)
dirb http://192.168.56.20 /usr/share/wordlists/dirb/common.txt

Useful flags: -x php,txt,bak adds file extensions, -t 50 sets threads, -s 200,301,403 filters status codes.

Ravindra Bagale's Tip

Ignore all the 404s, but never ignore a 403 – "forbidden" means the page exists, you just don't have access. Those pages often turn out to be interesting later. And always start with a small wordlist (common.txt), then move to a bigger one.

Lab

Run Gobuster against http://192.168.56.20 with common.txt and -x php,txt,bak. List every path that returns 200, 301 or 403. On your own reels app, run the same scan and check whether any backup file (.bak) or config is exposed – if so, remove it.