hack_tools
Quantum Algorithm Researcher
LEVEL 1
300 XP
Hey Folks, this article can be valuable for bug bounty hunters and CTF players because in this tutorial we will talk about the best hidden directory finder tools that will help you do enumeration.
What do you get ?
- gobuster
- dirb
- dirsearch
- Wfuzz
- konan
- dirhunt
- Metasploit
- disbuster
Lets take a look
!!Gobuster
Gobuster is an open source tool designed to force URI (files and directories) and DNS subdomains. The Gobuster tool provides a command line interface (CLI) that is built into the Go programming language. Downloading this tool is not difficult, just let us execute the following command.
apt-get install gobuster1apt-get install gobuster
After completing the download we can launch bruteforce attack to find the hidden directory in the web directory.
- -u –url string
- -w –wordlist string
- -s –statuscodes string
gobuster dir -u http://192.168.0.106/bolt/ -w /usr/share/wordlists/dirb/big.txt -s 200,302,3011gobuster dir-u
http://192.168.0.106/bolt/ -w /usr/share/wordlists/dirb/big.txt -s 200,302,301
We can use the “-x” syntax to find the specifics extension files.
- -x –extensions string
gobuster dir -u http://192.168.0.106/bolt/ -w /usr/share/wordlists/dirb/big.txt -x php1gobuster dir-u
http://192.168.0.106/bolt/ -w /usr/share/wordlists/dirb/big.txt -x php
DIRB
When we will exeute the following command it will start the brute force attack and dumps the all hidden directory.
dirb http://192.168.0.106/bolt/1dirb http://192.168.0.106/bolt/
Similary we can use the given syntax to find the specifics files or directory.
- -X = extensions
dirb http://192.168.0.106/secnhack/ -X .php1dirb http://192.168.0.106/secnhack/ -X .php
Dirsearch
Download this tool from github page and when the downloaded is complete the directory will be automatically created on terminal after then we can start this tool by using the python tool.
git clone https://github.com/maurosoria/dirsearch.git
cd dirsearch
python3 dirsearch.py -h123git clone
https://github.com/maurosoria/dirsearch.gitcd dirsearchpython3 dirsearch.py-h
Now we will launch brute force attack with extension facility.
- -u = url
- -w = wordlist
- -e = specifics extensions
python3 dirsearch.py -u http://192.168.0.106/secnhack/ -w /usr/share/dirb/wordlists/common.txt -e .php1python3 dirsearch.py-u
http://192.168.0.106/secnhack/ -w /usr/share/dirb/wordlists/common.txt -e .php
Lets move on further and try to dump the results with specific status code.
- -x = hide response
python3 dirsearch.py -u http://192.168.0.106/secnhack/ -w /usr/share/dirb/wordlists/common.txt -e php -x 400,4031python3 dirsearch.py-u
http://192.168.0.106/secnhack/ -w /usr/share/dirb/wordlists/common.txt -e php -x 400,403
Wfuzz
Wfuzz is in-built in Kali Linux, hence we can start this by type “wfuzz” on terminal. Keep in mind we have to mention the “FUZZ” word after the URLs.
- –hc = status
- -u = url
- -w = wordlist
wfuzz -u http://192.168.0.106/secnhack/FUZZ/ -w /usr/share/dirb/wordlists/common.txt --hc 400,404,4031wfuzz-u
http://192.168.0.106/secnhack/FUZZ/ -w /usr/share/dirb/wordlists/common.txt --hc 400,404,403
Konan
First we will download this tool from Gitub and after that we will have to fulfill some requirements of this tool by executing the following command.
git clone https://github.com/m4ll0k/Konan.git konan
cd konan && pip install -r requirements.txt12git clone
https://github.com/m4ll0k/Konan.git konancd konan&&pip install-rrequirements.txt
Lets take a example and try to dump the directory list.
python3 konan.py -u http://192.168.0.106/secnhack/ -w /usr/share/dirb/wordlists/common.txt1python3 konan.py-u
http://192.168.0.106/secnhack/ -w /usr/share/dirb/wordlists/common.txt
Now we will uses the exclude feature of this tool to skip the some status code.
- -x = –exclude
python3 konan.py -u http://192.168.0.106/secnhack/ -w /usr/share/dirb/wordlists/common.txt -x 400,4031python3 konan.py-u
http://192.168.0.106/secnhack/ -w /usr/share/dirb/wordlists/common.txt -x 400,403
Dirhunt
We do not have to make much effort to download this tool, we can download it by pip tool.
sudo pip3 install dirhunt1sudo pip3 install dirhunt
Dirhunt can be a useful tool to find hidden directories of live websites.
- -x = exclude
dirhunt http://192.168.0.106/secnhack/ -x 400,4021dirhunt http://192.168.0.106/secnhack/ -x 400,402
Metasploit
Start the metasploit framework by type “msfconsole” on terminal and then enter the following command. After execute the following
command it will gives the result such as below given image.
msf5 exploit(multi/handler) > use auxiliary/scanner/http/dir_scanner
msf5 auxiliary(scanner/http/dir_scanner) > set rhosts 192.168.0.106
msf5 auxiliary(scanner/http/dir_scanner) > set path secnhack/
msf5 auxiliary(scanner/http/dir_scanner) > set dictionary /usr/share/dirb/wordlists/common.txt
msf5 auxiliary(scanner/http/dir_scanner) > run12345msf5 exploit(multi/handler)>useauxiliary/scanner/http/dir_scannermsf5 auxiliary(scanner/http/dir_scanner)>set rhosts192.168.0.106msf5 auxiliary(scanner/http/dir_scanner)>set path secnhack/msf5 auxiliary(scanner/http/dir_scanner)>set dictionary/usr/share/dirb/wordlists/common.txtmsf5 auxiliary(scanner/http/dir_scanner)>run
Disbuster
When we enter the “dirbuster” it will automatically opened in our terminal and in which we need to submit the target details as shown given below.
As you can see it has dumped all the hidden directories.
