21. Web Application Testing Tools
21.5 Gobuster and Dirb: Finding Hidden Content
Web servers var khup pages links madhun disat nahit – /admin, /backup, /config.php, old files. Directory brute-forcing tools ek wordlist gheun pratyek naav try kartat aani konte exist kartat te sangtat (HTTP status codes: 200 found, 301/302 redirect, 403 forbidden-but-there, 404 not found).
# Gobuster (fast, written in Go)
gobuster dir -u http://192.168.56.20 -w /usr/share/wordlists/dirb/common.txt
gobuster dir -u http://192.168.56.20/dvwa -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,bak
gobuster dns -d lab.local -r 192.168.56.20 -w /usr/share/wordlists/subdomains-top1million-5000.txt # subdomains
# Dirb (classic, simple)
dirb http://192.168.56.20 /usr/share/wordlists/dirb/common.txt
Useful flags: -x php,txt,bak adds file extensions, -t 50 sets threads, -s 200,301,403 filters status codes.
Ravindra Bagale's Tip
404 sagle ignore kara, pan 403 kadhihi ignore karu naka – "forbidden" mhanje te page tithe aahe, fakt access nahi. Tech pages nantar interesting nightat. Aani nehmi lahaan wordlist ne suru kara (common.txt), mag mothi.
Lab
Run Gobuster against http://192.168.56.20 with common.txt and -x php,txt,bak. List every path that returns 200, 301 or 403. On your own reels app, run the same scan and check whether any backup file (.bak) or config is exposed – if so, remove it.