Dirb: Scanning Directories and Files on Web Servers

Dirb is one of the first tools I learned when I started doing web application penetration testing, and it’s still the tool I mentally reach for when I want something dead simple and dependable — no GUI, no complicated flag combinations, just a wordlist and a target URL.

What Is Dirb?

Dirb is a command-line web content scanner written in C. It works by launching a dictionary-based attack against a web server, requesting each word from a wordlist as a potential file or directory path, and reporting which ones exist based on HTTP response codes. Unlike ffuf, it doesn’t use a FUZZ placeholder system — instead, it simply appends each wordlist entry to the target URL.

It ships with its own set of wordlists under /usr/share/dirb/wordlists/, most notably common.txt, which has become something of a default first pass across the industry, even used by other tools.

How It Works Internally

Dirb’s scanning logic is straightforward:

• Reads a wordlist line by line.
• Builds a request URL by concatenating the base URL with each word (optionally with a specified extension).
• Sends an HTTP request (GET by default) and inspects the response code.
• Dirb also performs its own basic “not found” detection — it tests a random, clearly nonexistent path first to establish a baseline for servers that return HTTP 200 for everything (soft-404 pages), so it doesn’t flood you with false positives.
• On finding a directory (a 301/302 redirect to a path ending in /, or a 200 on a path resembling a directory), Dirb can recursively scan into it depending on options.

Because it’s written in C with a relatively simple single-threaded (or lightly multi-threaded via -z/-w) design, it’s slower than Go-based fuzzers, but very predictable and low-resource.

Installation

Preinstalled on Kali Linux. On other Debian-based systems:

sudo apt update
sudo apt install dirb

Verify:

dirb

Basic Syntax

dirb <url> [wordlist] [options]

Simple Scan

dirb http://192.168.56.101/

This uses the default wordlist (/usr/share/dirb/wordlists/common.txt) if none is specified.

Sample Output

-----------------
DIRB v2.22
By The Dark Raver
-----------------

START_TIME: Thu Jul 30 10:20:11 2026
URL_BASE: http://192.168.56.101/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612

---- Scanning URL: http://192.168.56.101/ ----
+ http://192.168.56.101/admin (CODE:301|SIZE:313)
+ http://192.168.56.101/config.php (CODE:200|SIZE:0)
+ http://192.168.56.101/index.php (CODE:200|SIZE:4521)
+ http://192.168.56.101/robots.txt (CODE:200|SIZE:45)
==> DIRECTORY: http://192.168.56.101/uploads/

---- Entering directory: http://192.168.56.101/uploads/ ----
+ http://192.168.56.101/uploads/.htaccess (CODE:403|SIZE:279)

-----------------
END_TIME: Thu Jul 30 10:21:40 2026
DOWNLOADED: 9224 - FOUND: 5

Common Flags

Extension-Aware Scan

dirb http://192.168.56.101/ /usr/share/dirb/wordlists/common.txt -X .php,.bak,.txt

Scanning with a Delay (Evading Rate Limits)

dirb http://192.168.56.101/ -z 200

Authenticated Scan

dirb http://192.168.56.101/admin/ -u admin:P@ssw0rd123

Real-World Use Case (Authorized Lab Only)

On a lab target with a WordPress-like structure but heavily customized, I used Dirb with a custom extension list (-X .php.bak,.old,.zip) to hunt for leftover backup files developers sometimes forget to remove after an update. Dirb’s recursive-by-default behavior found a nested /wp-content/uploads/2024/backup/ directory that wasn’t linked anywhere in the site, containing a .sql.bak file with database credentials — again, strictly within an authorized lab scope.

Workflow Integration

• Nmap → confirm web ports and server banner first.
• Dirb → baseline content discovery, especially good as a fast first pass given its predictable, low-noise output.
• ffuf/DirBuster → follow up with more targeted or higher-throughput fuzzing once Dirb establishes a baseline.
• Nikto → complement Dirb’s content discovery with vulnerability-specific checks.

Performance Optimization

• Use -z carefully — too high a delay makes scans painfully slow, too low risks tripping rate limiting or WAF blocking on production-like targets.
• Since Dirb is single-threaded by nature (no -t thread flag like ffuf), don’t expect ffuf-level speed; use it where thoroughness and low noise matter more than raw speed.
• Trim wordlists to relevant technology stacks (e.g., a PHP-specific wordlist for a PHP site) to cut scan time significantly.

Troubleshooting & Common Mistakes

• Getting flooded with results on a soft-404 server — Dirb’s baseline detection usually catches this, but if it doesn’t, manually verify a “found” path resembles a genuinely different response.
• Scan seems to hang — recursive scanning is on by default and can dive very deep on a content-heavy site; use -r to disable recursion if you just want a flat pass.
• Getting blocked mid-scan — add -z delay and a realistic -a User-Agent string to reduce the chance of a WAF flagging obvious automated scanning behavior.

Best Practices

• Start with Dirb’s default common.txt for a fast first pass before moving to larger, more specific wordlists.
• Always check scope/authorization — recursive scanning can generate a large volume of requests quickly.
• Save output with -o for every scan so you have a clean record for your report, rather than relying on terminal scrollback.

FAQ

Is Dirb faster or slower than ffuf? Slower — Dirb doesn’t have the same concurrency model as Go-based ffuf, but it’s stable, predictable, and sufficient for many day-to-day scans.

Does Dirb support recursive scanning by default? Yes, unlike many other tools, Dirb recurses into discovered directories automatically unless you pass -r to disable it.

Can Dirb fuzz parameters or POST bodies like ffuf? No — Dirb is purpose-built for path/file discovery only.

Summary

Dirb remains a reliable, no-frills choice for web content discovery. It won’t win any speed competitions against modern Go-based fuzzers, but its predictable recursive scanning, sensible soft-404 detection, and simple syntax make it a solid first pass in almost any web assessment — and it’s often the tool I still use simply because it’s fast to set up and hard to misconfigure.

References

• Official Dirb page: https://dirb.sourceforge.net/
• Kali Linux Tools: https://www.kali.org/tools/dirb/
• Man page: man dirb