21. Web Application Testing Tools
21.5 Gobuster and Dirb: Finding Hidden Content
Web servers var khup pages links madhun disat nahit – /admin, /backup, /config.php, old files. Directory brute-forcing tools ek wordlist gheun pratyek naav try kartat aani konte exist kartat te sangtat (HTTP status codes: 200 found, 301/302 redirect, 403 forbidden-but-there, 404 not found).
# Gobuster (fast, written in Go)
gobuster dir -u http://192.168.56.20 -w /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://192.168.56.20/dvwa -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,bak
gobuster dns -d lab.local -r 192.168.56.20 -w /usr/share/wordlists/subdomains-top1million-5000.txt # subdomains
# Dirb (classic, simple)
dirb http://192.168.56.20 /usr/share/wordlists/dirb/common.txt
Useful flags: -x php,txt,bak adds file extensions, -t 50 sets threads, -s 200,301,403 filters status codes.
Ravindra Bagale's Tip
Ignore all the 404s, but never ignore a 403 – "forbidden" means the page exists, you just don't have access. Those pages often turn out to be interesting later. And always start with a small wordlist (common.txt), then move to a bigger one.
Ravindra Bagale's Tip – मराठी
404 सगळे ignore करा, पण 403 कधीही ignore करू नका – "forbidden" म्हणजे ते page तिथे आहे, फक्त access नाही. तेच pages नंतर interesting निघतात. आणि नेहमी लहान wordlist ने सुरू करा (common.txt), मग मोठी.
Ravindra Bagale's Tip – हिंदी
सारे 404 ignore करो, पर 403 कभी ignore मत करना – "forbidden" मतलब वह page वहाँ है, बस access नहीं है. वही pages बाद में interesting निकलते हैं. और हमेशा छोटी wordlist से शुरू करो (common.txt), फिर बड़ी.
Lab
Run Gobuster against http://192.168.56.20 with common.txt and -x php,txt,bak. List every path that returns 200, 301 or 403. On your own reels app, run the same scan and check whether any backup file (.bak) or config is exposed – if so, remove it.