So I've been attempting to use dirbuster to fuzz a few vulnerable machines. I haven't been satisfied with the outputs so I started trying some manual fuzzing and then referencing the default dirbuster wordlist as well as others to make sure it wasn't a singular issue.

For example, when fuzzing using the default dirbuster medium size wordlist, 5 results appear. I know I can manually get 200 & 403 responses from pages like /config, /admin, or /mail, but they are not appearing in my dirbuster results even though they exist in the wordlist I'm using. I get an output like /error, /icons, /mailman, /pipermail, /cgi-bin, and nothing else, even though I verified the other pages exist in the wordlist and manually test correctly. Does anyone out ther have an idea on what mistake I'm making that is getting such a weird output?

  • 1
    I can only recommend to use an other software. My favorite for the moment is dirb. – maggick Apr 10 '18 at 7:31
  • That's a good idea, I've been messing with it and rerunning scans in the background hoping I could figure out what I was doing wrong. And now that I think about it, it could be because I didn't launch dirbuster with sudo privilege. – Hadoken Apr 10 '18 at 7:42
  • @Hadoken why would dirbuster need to be run as root? – AndrolGenhald Apr 10 '18 at 13:38
  • @AndrolGenhald I'm inexperienced with the software and thought maybe it could be an issue with how the software was making requests. However I do believe it's an issue with its configuration, I'm just blind and not knowledgeable enough to understand my mistakes. – Hadoken Apr 10 '18 at 15:16
  • 1
    @Hadoken Your first instinct upon software not working should not be "Let's try it as root!" At the very least make sure that it actually needs such privileges. – AndrolGenhald Apr 10 '18 at 15:19

I love the OWASP project and community (I'm actually part of it), but I don't like DirBuster at all, which is an OWASP project. It's very slow compared to other similar tools, and it easily crashes if you try to load a big wordlist.

"Does anyone out there have an idea on what mistake I'm making that is getting such a weird output?"

You may be not making any mistakes; from my experience about 1-2 years ago DirBuster seemed a fairly unreliable tool, especially when using middle/large-sized lists, so it may be simply malfunctioning.

I strongly recommend gobuster. It's a command line tool, fairly flexible, and super fast. Most pentesters I know choose gobuster over any other similar free tools.

You could start with a command like the following one, explore the different options, and tune it according to your specific needs:

gobuster -u http://A.B.C.D/ -w /usr/share/seclists/Discovery/Web-Content/raft-large-words-lowercase.txt -s 200,204,301,302,307,403,500 -e

If you don't have one already, I recommend you get a Kali Linux VM so you can have lots of tools (including gobuster, dirb, and DirBuster) to play around with. Kali also comes with many good wordlists such as the one referenced in the command above.

| improve this answer | |
  • Although this might be good advice, it doesn't answer the original question. – forest May 14 '18 at 1:10
  • 1
    @forest Fair enough. For the question "Does anyone out there have an idea on what mistake I'm making that is getting such a weird output?", I'll answer: you may be not making any mistakes; from my experience DirBuster is a fairly unreliable tool (especially when you use middle/large-sized lists), so it may be simply malfunctioning. – act1vand0 May 14 '18 at 3:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.