DIRB官方地址:
http://dirb.sourceforge.net/

简介(摘自官方原文):

DIRB is a Web Content Scanner. It looks for existing (and/or hidden) Web Objects. It basically works by launching a dictionary based attack against a web server and analizing the response.

介绍:

DIRB是一个基于命令行的工具,依据字典来爆破目标Web路径以及敏感文件,它支持自定义UA,cookie,忽略指定响应吗,支持代理扫描,自定义毫秒延迟,证书加载扫描等。是一款非常优秀的全方位的目录扫描工具。同样Kaili内置了dirb。

攻击机:
192.168.1.104 Debian
靶机:
192.168.1.102 Windows 2003 IIS

第二十九课:发现目标WEB程序敏感目录第一季 - 图1

普通爆破:

  1. root@John:~/wordlist/small# dirb http://192.168.1.102 ./ASPX.txt
  2. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  3. DIRB v2.22
  4. By The Dark Raver
  5. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  6. START_TIME: Sun Feb 17 23:26:52 2019
  7. URL_BASE: http://192.168.1.102/
  8. WORDLIST_FILES: ./ASPX.txt
  9. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  10. GENERATED WORDS: 822
  11. ‐‐‐‐ Scanning URL: http://192.168.1.102/ ‐‐‐‐
  12. + http://192.168.1.102//Index.aspx (CODE:200|SIZE:2749)
  13. + http://192.168.1.102//Manage/Default.aspx (CODE:302|SIZE:203)
  14. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  15. END_TIME: Sun Feb 17 23:26:56 2019
  16. DOWNLOADED: 822 FOUND: 2

第二十九课:发现目标WEB程序敏感目录第一季 - 图2

多字典挂载:

  1. root@John:~/wordlist/small# dirb http://192.168.1.102 ./ASPX.txt,./DIR.txt
  2. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  3. DIRB v2.22
  4. By The Dark Raver
  5. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  6. START_TIME: Sun Feb 17 23:31:02 2019
  7. URL_BASE: http://192.168.1.102/
  8. WORDLIST_FILES: ./ASPX.txt,./DIR.txt
  9. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  10. GENERATED WORDS: 1975
  11. ‐‐‐‐ Scanning URL: http://192.168.1.102/ ‐‐‐‐
  12. + http://192.168.1.102//Index.aspx (CODE:200|SIZE:2749)
  13. + http://192.168.1.102//Manage/Default.aspx (CODE:302|SIZE:203)
  14. + http://192.168.1.102//bbs (CODE:301|SIZE:148)
  15. + http://192.168.1.102//manage (CODE:301|SIZE:151)
  16. + http://192.168.1.102//manage/ (CODE:302|SIZE:203)
  17. + http://192.168.1.102//kindeditor/ (CODE:403|SIZE:218)
  18. + http://192.168.1.102//robots.txt (CODE:200|SIZE:214)
  19. + http://192.168.1.102//Web.config (CODE:302|SIZE:130)
  20. + http://192.168.1.102//files (CODE:301|SIZE:150)
  21. + http://192.168.1.102//install (CODE:301|SIZE:152)
  22. (!) FATAL: Too many errors connecting to host
  23. (Possible cause: EMPTY REPLY FROM SERVER)
  24. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  25. END_TIME: Sun Feb 17 23:31:06 2019
  26. DOWNLOADED: 1495 FOUND: 10

第二十九课:发现目标WEB程序敏感目录第一季 - 图3

自定义UA:

  1. root@John:~/wordlist/small# dirb http://192.168.1.102 ./ASPX.txt ‐a "M
  2. ozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
  3. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  4. DIRB v2.22
  5. By The Dark Raver
  6. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  7. START_TIME: Sun Feb 17 23:34:51 2019
  8. URL_BASE: http://192.168.1.102/
  9. WORDLIST_FILES: ./ASPX.txt
  10. USER_AGENT: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
  11. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  12. GENERATED WORDS: 822
  13. ‐‐‐‐ Scanning URL: http://192.168.1.102/ ‐‐‐‐
  14. + http://192.168.1.102//Index.aspx (CODE:200|SIZE:2735)
  15. + http://192.168.1.102//Manage/Default.aspx (CODE:302|SIZE:203)
  16. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  17. END_TIME: Sun Feb 17 23:34:54 2019
  18. DOWNLOADED: 822 ‐ FOUND: 2

第二十九课:发现目标WEB程序敏感目录第一季 - 图4

  1. root@John:~/wordlist/small# dirb http://192.168.1.102/Manage ./DIR.txt
  2. a "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.ht
  3. ml)" c "ASP.NET_SessionId=jennqviqmc2vws55o4ggwu45"
  4. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  5. DIRB v2.22
  6. By The Dark Raver
  7. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  8. START_TIME: Sun Feb 17 23:53:08 2019
  9. URL_BASE: http://192.168.1.102/Manage/
  10. WORDLIST_FILES: ./DIR.txt
  11. USER_AGENT: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.googl
  12. e.com/bot.html)
  13. COOKIE: ASP.NET_SessionId=jennqviqmc2vws55o4ggwu45
  14. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  15. GENERATED WORDS: 1153
  16. ‐‐‐‐ Scanning URL: http://192.168.1.102/Manage/ ‐‐‐‐
  17. + http://192.168.1.102/Manage//include/ (CODE:403|SIZE:218)
  18. + http://192.168.1.102/Manage//news/ (CODE:403|SIZE:218)
  19. + http://192.168.1.102/Manage//include (CODE:301|SIZE:159)
  20. + http://192.168.1.102/Manage//images/ (CODE:403|SIZE:218)
  21. + http://192.168.1.102/Manage//sys/ (CODE:403|SIZE:218)
  22. + http://192.168.1.102/Manage//images (CODE:301|SIZE:158)
  23. (!) FATAL: Too many errors connecting to host
  24. (Possible cause: EMPTY REPLY FROM SERVER)
  25. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  26. END_TIME: Sun Feb 17 23:53:10 2019
  27. DOWNLOADED: 673 FOUND: 6

自定义毫秒延迟:

  1. root@John:~/wordlist/small# dirb http://192.168.1.102/Manage ./DIR.txt
  2. a "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.ht
  3. ml)" c "ASP.NET_SessionId=jennqviqmc2vws55o4ggwu45" z 100
  4. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  5. DIRB v2.22
  6. By The Dark Raver
  7. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  8. START_TIME: Sun Feb 17 23:54:29 2019
  9. URL_BASE: http://192.168.1.102/Manage/
  10. WORDLIST_FILES: ./DIR.txt
  11. USER_AGENT: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.googl
  12. e.com/bot.html)
  13. COOKIE: ASP.NET_SessionId=jennqviqmc2vws55o4ggwu45
  14. SPEED_DELAY: 100 milliseconds
  15. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  16. GENERATED WORDS: 1153
  17. ‐‐‐‐ Scanning URL: http://192.168.1.102/Manage/ ‐‐‐‐
  18. + http://192.168.1.102/Manage//include/ (CODE:403|SIZE:218)
  19. + http://192.168.1.102/Manage//news/ (CODE:403|SIZE:218)
  20. + http://192.168.1.102/Manage//include (CODE:301|SIZE:159)
  21. + http://192.168.1.102/Manage//images/ (CODE:403|SIZE:218)
  22. + http://192.168.1.102/Manage//sys/ (CODE:403|SIZE:218)
  23. + http://192.168.1.102/Manage//images (CODE:301|SIZE:158)
  24. (!) FATAL: Too many errors connecting to host
  25. (Possible cause: EMPTY REPLY FROM SERVER)
  26. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  27. END_TIME: Sun Feb 17 23:55:50 2019
  28. DOWNLOADED: 673 FOUND: 6

第二十九课:发现目标WEB程序敏感目录第一季 - 图5

其他更多有趣的功能:

  1. DIRB v2.22
  2. By The Dark Raver
  3. ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
  4. dirb <url_base> [<wordlist_file(s)>] [options]
  5. ========================= NOTES =========================
  6. <url_base> : Base URL to scan. (Use resume for session resuming)
  7. <wordlist_file(s)> : List of wordfiles. (wordfile1,wordfile2,wordfile3...)
  8. ======================== HOTKEYS ========================
  9. 'n' ‐> Go to next directory.
  10. 'q' ‐> Stop scan. (Saving state for resume)
  11. 'r' ‐> Remaining scan stats.
  12. ======================== OPTIONS ========================
  13. a <agent_string> : Specify your custom USER_AGENT.
  14. b : Use path as is.
  15. c <cookie_string> : Set a cookie for the HTTP request.
  16. E <certificate> : path to the client certificate.
  17. f : Fine tunning of NOT_FOUND (404) detection.
  18. H <header_string> : Add a custom header to the HTTP request.
  19. i : Use caseinsensitive search.
  20. l : Print "Location" header when found.
  21. N <nf_code>: Ignore responses with this HTTP code.
  22. o <output_file> : Save output to disk.
  23. p <proxy[:port]> : Use this proxy. (Default port is 1080)
  24. P <proxy_username:proxy_password> : Proxy Authentication.
  25. r : Don't search recursively.
  26. ‐R : Interactive recursion. (Asks for each directory)
  27. ‐S : Silent Mode. Don't show tested words. (For dumb terminals)
  28. t : Don't force an ending '/' on URLs.
  29. ‐u <username:password> : HTTP Authentication.
  30. ‐v : Show also NOT_FOUND pages.
  31. ‐w : Don't stop on WARNING messages.
  32. X <extensions> / x <exts_file> : Append each word with this extensions.
  33. z <millisecs> : Add a milliseconds delay to not cause excessive Flood.
  34. ======================== EXAMPLES =======================
  35. dirb http://url/directory/ (Simple Test)
  36. dirb http://url/ X .html (Test files with '.html' extension)
  37. dirb http://url/ /usr/share/dirb/wordlists/vulns/apache.txt (Test wit hapache.txt wordlist)
  38. dirb https://secure_url/ (Simple Test with SSL)

第二十九课:发现目标WEB程序敏感目录第一季 - 图6

Micropoor