Dirb brute-forces a wordlist of common directory and file names against a web server and reports everything it finds that doesn't return 404. It's one of the first steps in reconnaissance for a web application security assessment: before attacking anything, you map what surface is actually exposed.
Provide a URL (e.g. example.com or https://example.com/app/). The scanner streams each discovered path back to your browser as it walks through the wordlist.
Typical findings
- /admin, /backup, /old, /test — legacy paths forgotten in production.
- /.git, /.env, /config.php.bak — misconfigured deploys leaking source or secrets.
- /robots.txt, /sitemap.xml — not findings, but worth reading; they often reveal internal paths.
FAQ
Is this legal? You must have explicit permission to test any server you don't own. This tool is provided for defensive self-audit, bug-bounty programs that allow it, and authorised penetration tests.
What wordlist is used? The default dirb "common.txt" — about 4600 entries covering the most frequent web paths.
Why does the scan take minutes? Each entry in the wordlist requires one HTTP request. Target servers often rate-limit, adding delay.