There are many tools designed to brute force directories and files in webservers, for example:

Which are the features to consider when selecting the one to use?

  • 1
    The problem with this question is that you don't have a goal in mind, so it will be difficult to devise criteria. What do you want to accomplish with this type of scanner? And why choose one? Why not simply use as many as works for you on the target in question? – schroeder Jan 12 at 12:54
  • Just try them and see which one you like. – MechMK1 Jan 12 at 13:22
  • Answering with sentences like "try yourself" or "use all of them" does not help anyone interested in this subject. Since there are a plenty of tools to bruteforce filenames against a web server I want to hear what people can say about tools to carry out that work in the best manner. Concerning your "What do you want to accomplish with this type of scanner? " I'm glad to tell you that the main purpose of this kind of software is to discover hidden files or directory hosted by a web server. – frenkie Jan 12 at 13:57
  • 1
    So, then your criteria becomes simple: the tool finds paths. Once you start asking about features then those features need to be tied to benefits. But without a goal to benefit, the features don't have a place to land. What does "in the best manner" mean? How do you define "best"? – schroeder Jan 12 at 14:19
  • 1
    @frenkie The reason why the answer is "just try them" is because they're basically as good as every other. It's the same with TLS scaners. Is testssl.sh better than sslyze? No, I just like the way the output is formatted more. The information I get is pretty much the same everywhere. – MechMK1 Jan 14 at 13:26

When considering a web path scanner, the following features should be considered, in order of importance.


If you can't get it to run on your system, it's no good to you.


The larger the dictionaries that come with the scanner, the better coverage your scanning will get. Also, it should be easy to specify a custom dictionary if you want to.


Output varies, but it's important that 'found' paths are clearly indicated. It's less important, but still useful, to get some progress indication as the scan goes along.


Relatively unimportant. Web path scanning need not be a real-time affair, you can just fire it and forget about it while you do something else.


Not the answer you're looking for? Browse other questions tagged or ask your own question.