{"id": "KITPLOIT:3551777842246559430", "bulletinFamily": "tools", "title": "Dirble - Fast Directory Scanning And Scraping Tool", "description": "[  ](<https://1.bp.blogspot.com/-YPIEZBt6w5c/XmnA6g3F5hI/AAAAAAAAR6E/5cfiyO6awL8p8CD8z90HEIqYm9PJ8DB7gCNcBGAsYHQ/s1600/dirble_1_comparison_graph.png>)\n\n \nDirble is a website directory [ scanning ](<https://www.kitploit.com/search/label/Scanning> \"scanning\" ) tool for Windows and Linux. It's designed to be fast to run and easy to use. \n \n** How to Use ** \nDownload one of the [ precompiled binaries ](<https://github.com/nccgroup/dirble/releases/latest> \"precompiled binaries\" ) for Linux, Windows, or Mac, or compile the source using Cargo, then run it from a terminal. The default wordlist Dirble uses is dirble_wordlist.txt in the same directory as the executable. \nIt can be installed in [ BlackArch ](<https://www.kitploit.com/search/label/BlackArch> \"BlackArch\" ) using ` sudo pacman -S dirble ` \nThere is also a docker image, which can be run as: ` docker run --rm -t isona/dirble [dirble arguments] ` \nThe help text can be displayed using ` dirble --help ` , alternatively it can be found on the github wiki: [ https://github.com/nccgroup/dirble/wiki/Help-Text ](<https://github.com/nccgroup/dirble/wiki/Help-Text> \"https://github.com/nccgroup/dirble/wiki/Help-Text\" ) \n \n** Example Uses ** \nRun against a website using the default dirble_wordlist.txt from the current directory: ` dirble [address] ` \nRun with a different wordlist and including .php and .html extensions: ` dirble [address] -w example_wordlist.txt -x .php,.html ` \nWith listable directory [ scraping ](<https://www.kitploit.com/search/label/Scraping> \"scraping\" ) enabled: ` dirble [address] --scrape-listable ` \nProviding a list of extensions and a list of hosts: ` dirble [address] -X wordlists/web.lst -U hostlist.txt ` \nProviding multiple hosts to scan via command line: ` dirble [address] -u [address] -u [address] ` \nRunning with [ threading ](<https://www.kitploit.com/search/label/Threading> \"threading\" ) in Gobuster's default style, disabling recursion and having 10 threads scanning the main directory: ` dirble [address] --max-threads 10 --wordlist-split 10 -r ` \n \n** Building from source ** \nTo build on your current platform, ensure cargo is installed and then run ` cargo build --release ` . Alternatively, running ` make ` will build the binary in release mode (internally running ` cargo build --release ` ). \nTo cross-compile for 32- and 64-bit Linux and Windows targets, there is a handy makefile. ` make release ` will build for all four targets using ` cross ` . This depends on having cross and docker installed ( ` cargo install cross ` ). \n \n** Features ** \n\n\n * Cookies \n * Custom Headers \n * Extensions and prefixes \n * HTTP basic auth \n * Listable directory detection and scraping \n * Save ouptut to file \n * Save output in XML and JSON formats \n * Proxy support \n * Recursion \n * Status code blacklisting and whitelisting \n * Threading \n * Request throttling \n * Detect not found code of each directory based on response code and length \n * Ability to provide list of URLs to be scanned \n * User agents \n * Scanning with GET, POST or HEAD requests \n * Exclude ranges of response lengths from output \n \n** Performance ** \nThe following graph was generated by running each tool with Hyperfine against a test server with 5ms latency and 1% packet loss. (Gobuster was omitted due to lack of recursion). \n \n \n\n\n[  ](<https://1.bp.blogspot.com/-YPIEZBt6w5c/XmnA6g3F5hI/AAAAAAAAR6E/5cfiyO6awL8p8CD8z90HEIqYm9PJ8DB7gCNcBGAsYHQ/s1600/dirble_1_comparison_graph.png>)\n\n \n** How it works ** \n \n** Directory Detection ** \nDirble detects files based on the response code sent by the server. The behaviour can be loosely categorised by response code type. \n\n\n * ` 200 ` : the path exists and is valid \n * ` 301, 302 ` : redirection; report the code, size, and Location header \n * ` 404 ` : not found; by default these responses are not reported \n * All other response codes are reported in the Dirble format of ` + [url] (CODE:[code]|SIZE:[size]) `\nA path is classified as a _ directory _ if a request to ` [url] ` (with _ no _ trailing slash) returns a 301 or 302 redirection to ` [url]/ ` ( _ with _ a trailing slash). This gets reported with a ` D ` prefix and if recursion is enabled will be added to the scan queue. This method is not dependent on the redirection target existing or being accessible, so a separate request will be made to determine the response code and size of the directory. \nListable directories are detected by inspecting the content of ` url/ ` : if it returns a 200 response code and the body contains either \"parent directory\", \"up to \" or \"directory listing for\" (case insensitive), then it is likely to be a listable directory. If ` --scrape-listable ` is enabled, URLs are parsed out of the listing (ignoring sorting links or out of scope links) and added to the scan queue if they have a trailing slash. Listable directories have an ` L ` prefix in the output. \n \n** Threading ** \nThe threading behaviour of Dirble is based on the concepts of _ wordlists _ and _ jobs _ . A _ job _ is any task which can be run independently of other tasks, for example requesting a series of URLs. A _ wordlist _ is a list of words with a defined transformation, for example the list ` {admin, config, shop} ` together with the transformation ` append \".php\" ` forms a single wordlist instance. \nTo improve [ performance ](<https://www.kitploit.com/search/label/Performance> \"performance\" ) further, we introduce the concept of _ wordlist splitting _ . This is the process by which a single _ wordlist _ instance ( _ i.e. _ words with a transformation) is broken up into multiple jobs, each responsible for a portion of the list. The number of interleaved portions that each wordlist is split into is defined by the ` --wordlist-split ` option (default 3). \nWhenever a directory is detected (and recursion is enabled) new jobs are created for each split wordlist (with transformation) and added to a central _ job queue _ . \nThe maximum number of concurrent tasks is defined by the ` --max-threads ` parameter, and Dirble will start jobs as they are added to the queue, up to this limit. Whenever a job completes ( _ i.e. _ a split wordlist is exhausted) Dirble will take the next job from the queue and start it. \nReleased under GPL v3.0, see LICENSE for more information \n \n \n\n\n** [ Download Dirble ](<https://github.com/nccgroup/dirble> \"Download Dirble\" ) **\n", "published": "2020-03-12T20:30:08", "modified": "2020-03-12T20:30:08", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "http://www.kitploit.com/2020/03/dirble-fast-directory-scanning-and.html", "reporter": "KitPloit", "references": ["https://github.com/nccgroup/dirble/wiki/Help-Text", "https://github.com/nccgroup/dirble", "https://github.com/nccgroup/dirble/releases/latest"], "cvelist": [], "type": "kitploit", "lastseen": "2020-12-09T15:22:24", "edition": 7, "viewCount": 43, "enchantments": {"dependencies": {"references": [], "modified": "2020-12-09T15:22:24", "rev": 2}, "score": {"value": -0.1, "vector": "NONE", "modified": "2020-12-09T15:22:24", "rev": 2}, "vulnersScore": -0.1}, "toolHref": "https://github.com/nccgroup/dirble", "scheme": null}

{}