Information Gathering

dirb

dirb is the old reliable of web content discovery. It takes a base URL and a wordlist and walks the server looking for directories and files that exist but aren’t linked anywhere, recursing into what it finds. It predates the Go-based speed demons and it’s slower than they are, but it’s dependable, it ships its own wordlists, and it’s often the first thing reached for on a quick look.

Installed from the AUR; Security → Information Gathering → dirb.

The help it prints

-----------------
DIRB v2.22    
By The Dark Raver
-----------------


(!) FATAL: Invalid URL format: --help/
    (Use: "http://host/" or "https://host/" for SSL)

Examples

# Scan with dirb's own default wordlist
dirb http://10.0.0.5

# Use a specific wordlist
dirb http://10.0.0.5 /usr/share/seclists/Discovery/Web-Content/common.txt

# Look for particular extensions, non-recursive
dirb http://10.0.0.5 -X .php,.bak -r

# Authenticated scan with a cookie
dirb http://10.0.0.5 -c "session=abc123"