dirb
DIRB is a lightweight, C-based web content scanner that launches dictionary-based attacks against web servers to find existing (and/or hidden) objects. It predates gobuster and ffuf as the standard command-line brute-forcer on Kali Linux, and remains useful for quick, low-overhead directory enumeration when a full-featured fuzzer is overkill.
Basic usage
dirb http://$TARGET /usr/share/wordlists/dirb/common.txtDIRB ships with its own wordlists under /usr/share/wordlists/dirb/ (including common.txt, big.txt, and catala.txt/spanish.txt for non-English targets). The tool recursively descends into discovered directories by default and reports each hit with HTTP response code and size.
Key options
| Option | Purpose |
|---|---|
-a <agent> | Custom User-Agent string |
-c <cookie> | Set a cookie for requests |
-H <header> | Add a custom HTTP header |
-i | Case-insensitive search |
-N <code> | Ignore responses with this HTTP code |
-o <file> | Save output to disk |
-p <proxy> | Route through a proxy |
-r | Don’t search recursively |
-R | Interactive recursion (prompt per directory) |
-S | Silent mode (no tested words shown) |
-t | Don’t force trailing / on URLs |
-u <user:pass> | HTTP basic authentication |
-v | Show non-existent pages too |
-w | Don’t stop on WARNING messages |
-x <file> | Amplify search with extensions from file |
-X <exts> | Amplify search with these extensions |
-z <ms> | Delay between requests in milliseconds |
Companion utilities
dirb-gendict— generate custom wordlists by pattern (numeric, character, hex, etc.)html2dic— extract all words from an HTML page to build a target-specific dictionary
When to reach for dirb
DIRB is simpler and lighter than gobuster/ffuf — no modes to remember, no complex flag syntax. It’s the right choice when:
- You need a quick sanity check for common directories (
/admin,/backup,/images) - The target is slow or rate-limited and you want minimal overhead
- You’re working in a constrained environment where Go binaries aren’t available
For serious enumeration, gobuster or ffuf are faster and more configurable. For GUI work, dirbuster still ships with Kali. For known-file and server-misconfiguration scanning, nikto is the complementary tool.