Find the hidden folders on any website.
Dirb is a tool that looks for secret pages on a website. It works by guessing names from a massive list of words. If it guesses right, you find the secret.
$ dirb http://website.com
-----------------
DIRB v2.22
-----------------
STARTING...
Testing: /admin/ (FOUND)
Testing: /backup/ (FOUND)
Testing: /secret/ (MISSING)
The Website Map
- /home Public
- /contact Public
- /database-backup Hidden!
- /old-admin-panel Hidden!
The Hidden Door Problem
Websites are like houses. They have a front door for everyone. But sometimes, the builders leave a back door unlocked.
These back doors can be old folders, backup files, or private tools. They do not have links pointing to them. But if you type the exact right name in your browser, you can see them.
How It Works: Rapid Guessing
Read a Word
Dirb looks at a giant list of common folder names. It picks the first word, like "admin".
Ask the Website
It asks the website: "Do you have a folder called /admin?"
Listen to Answer
If the website says "Yes, here it is!", Dirb writes it down. Then it tries the next word.
The Brains: Wordlists
Dirb is not smart by itself. It needs a list of words to guess. We call this a Wordlist.
A wordlist is just a very long text file. It is full of names that programmers often use by mistake when building websites.
Without a good wordlist, Dirb cannot find anything.
common_words.txt
admin
backup
test
old
config
login
setup
temp
secret
data
private
users
Where Are The Wordlists Kept?
If you use a security computer like Kali Linux, Dirb already comes with many wordlists. They are sorted into different folders based on what you are looking for.
To use a specific list, just type it at the end of your command:
$ dirb http://site.com /usr/share/wordlists/dirb/big.txt
How to Run It
Running Dirb is very easy. You only need to open your terminal and type two things: the tool name, and the website address.
This tells the computer to start the Dirb tool.
This is the exact website you want to test. Always include the http:// or https:// part.
Reading the Answers
When Dirb asks a website for a folder, the website replies with a secret number code. Here is what those numbers mean.
Success / Found
The website said: "Yes, I have this folder, and here it is!"
Forbidden / Locked
The website said: "I have this folder, but you are not allowed to look inside!"
Not Found
The website said: "I do not have anything named like that."
Dirb hides these so your screen stays clean.
Filtering Out The Noise
Sometimes a website is broken. It might reply with "Forbidden (403)" for every single word. This fills your screen with garbage.
You can tell Dirb to ignore certain numbers using the -N
command.
This command means: "Do not show me any answers that are Code 403. Only show me successes."
Looking for Files, Not Just Folders
Dirb normally looks for folders. But what if you want to find specific files, like text files or zip backups?
You can add a special instruction using -X.
This tells Dirb to add an ending (like .txt) to every word it guesses.
Folders Inside Folders
When Dirb finds a folder, it does not stop. It automatically walks inside that new folder and starts guessing words all over again.
This is called Recursion. It helps you dig very deep into a website to find things hidden layers down.
Dirb automatically starts scanning /admin/...
Dirb starts scanning /admin/users/...
Don't Lose Your Discoveries
Scanning a big website can take hours. If you close your terminal, all the text disappears. You should always save your work into a file.
The Saving Command
Use the letter -o (for
Output) followed by the name of the file you want to create.
Now you can open my_report.txt anytime to see what secret folders Dirb found.
Going Too Fast Can Crash Things
Dirb can guess hundreds of words in a single second. If you guess too fast, the website might break, or it might block your computer.
How to Slow Down
Use the -z command to
tell Dirb to wait before guessing the next word.
This means: Wait 500 milliseconds (half a second) between every guess.
Scanning Different Doors (Ports)
Most websites live on Port 80 (HTTP) or Port 443 (HTTPS). But sometimes, secret tools run on weird numbers like 8080 or 8443.
To tell Dirb to scan a weird port, you just add a colon : and the number at the end of the website
name.
Logging In First
If the website asks for a username and password before you can even see it, normal Dirb will fail. It will just get a bunch of "Denied" messages.
You can give Dirb the keys to the castle by using the -u command.
Syntax:
-u username:password
Example Command:
Custom Disguises (Headers)
Some websites check your "ID badge" (called a Cookie or Header). If you don't have the right badge, they block you.
Use -H to
give Dirb a custom badge.
Example: Adding a Session Cookie
Sending Traffic Through a Proxy
DIRB
WEBSITE
Professional testers like to record every single guess in a tool like Burp Suite. You
can force Dirb to send its traffic through another tool using the -p command.
Dirb vs The Competition
Dirb is a classic tool, but it is not the only one. How does it compare to modern scanners?
Dirb
- Very easy to learn.
- Built into Kali Linux.
- A bit slow.
Gobuster
- Extremely fast.
- Uses modern code (Go).
- Harder command line flags.
Dirbuster
- Has a visual mouse menu.
- Very old tool.
- Needs Java to run.
What Do Bad People Look For?
When testing security, we use Dirb to find mistakes before the bad guys do. Here are the worst things we often find hiding in plain sight.
Old Databases
Sometimes a copy of all the users and passwords is left behind in a folder called /db or /backups.
Source Code Files
Files ending in .bak or .old. These let people see exactly how your website is built, revealing weak spots.
Secret Admin Panels
A login page at /admin123 that bypasses normal security checks.
Configuration Files
Files that contain the main passwords for the server itself, usually called config.php.bak or .env.
The Golden Rule
Never scan a website you do not own.
Running Dirb against a random website is considered an attack in many countries. It is illegal. Only use this tool on your own websites, or on websites where you have clear, written permission from the owner to test their security.
How to Protect Your Website
You cannot stop people from running Dirb on your site. But you can stop them from finding anything useful.
- 1. Delete old files and backups. Never leave them on the server.
- 2. Lock everything. Ensure all folders require a password to view.
- 3. Turn off "Directory Listing" so people cannot see a list of your files.