0

So I've been attempting to use dirbuster to fuzz a few vulnerable machines. I haven't been satisfied with the outputs so I started trying some manual fuzzing and then referencing the default dirbuster wordlist as well as others to make sure it wasn't a singular issue.

For example, when fuzzing using the default dirbuster medium size wordlist, 5 results appear. I know I can manually get 200 & 403 responses from pages like /config, /admin, or /mail, but they are not appearing in my dirbuster results even though they exist in the wordlist I'm using. I get an output like /error, /icons, /mailman, /pipermail, /cgi-bin, and nothing else, even though I verified the other pages exist in the wordlist and manually test correctly. Does anyone out ther have an idea on what mistake I'm making that is getting such a weird output?

6
  • 1
    I can only recommend to use an other software. My favorite for the moment is dirb.
    – maggick
    Apr 10, 2018 at 7:31
  • That's a good idea, I've been messing with it and rerunning scans in the background hoping I could figure out what I was doing wrong. And now that I think about it, it could be because I didn't launch dirbuster with sudo privilege.
    – Hadoken
    Apr 10, 2018 at 7:42
  • @Hadoken why would dirbuster need to be run as root? Apr 10, 2018 at 13:38
  • @AndrolGenhald I'm inexperienced with the software and thought maybe it could be an issue with how the software was making requests. However I do believe it's an issue with its configuration, I'm just blind and not knowledgeable enough to understand my mistakes.
    – Hadoken
    Apr 10, 2018 at 15:16
  • 1
    @Hadoken Your first instinct upon software not working should not be "Let's try it as root!" At the very least make sure that it actually needs such privileges. Apr 10, 2018 at 15:19

1 Answer 1

3

I love the OWASP project and community (I'm actually part of it), but I don't like DirBuster at all, which is an OWASP project. It's very slow compared to other similar tools, and it easily crashes if you try to load a big wordlist.

"Does anyone out there have an idea on what mistake I'm making that is getting such a weird output?"

You may be not making any mistakes; from my experience about 1-2 years ago DirBuster seemed a fairly unreliable tool, especially when using middle/large-sized lists, so it may be simply malfunctioning.

I strongly recommend gobuster. It's a command line tool, fairly flexible, and super fast. Most pentesters I know choose gobuster over any other similar free tools.

You could start with a command like the following one, explore the different options, and tune it according to your specific needs:

gobuster -u http://A.B.C.D/ -w /usr/share/seclists/Discovery/Web-Content/raft-large-words-lowercase.txt -s 200,204,301,302,307,403,500 -e

If you don't have one already, I recommend you get a Kali Linux VM so you can have lots of tools (including gobuster, dirb, and DirBuster) to play around with. Kali also comes with many good wordlists such as the one referenced in the command above.

2
  • Although this might be good advice, it doesn't answer the original question.
    – forest
    May 14, 2018 at 1:10
  • 1
    @forest Fair enough. For the question "Does anyone out there have an idea on what mistake I'm making that is getting such a weird output?", I'll answer: you may be not making any mistakes; from my experience DirBuster is a fairly unreliable tool (especially when you use middle/large-sized lists), so it may be simply malfunctioning.
    – act1vand0
    May 14, 2018 at 3:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .