OWASP DirBuster - Training

James Fisher
DirBuster Project Lead
dirbuster@sittinglittleduckc.com

OWASP
May 2010

Copyright © The OWASP Foundation

Permission is granted to copy, distribute and/or modify this document
under the terms of the OWASP License.

The OWASP Foundation

http://www.owasp.org
Introductions – Who Am I

Name: James Fisher

Contact: dirbuster@sittinglittleduck.com

OWASP Role: DirBuster Project Lead

Day Job: Senior Security Consultant @ Portcullis

Computer Security Ltd

Time In Computer Security: 7+ Years

OWASP
2
What's To Come?

OWASP
3
What is DirBuster?

A web application file and directory brute forcer

Designed to find hidden and unlinked content

Uses custom lists to do this

Both GUI and limited command line

OWASP
4
Features Overview

Multi threaded has been recorded at over 6000 requests/sec

Works over both http and https
Scan for both directory and files
Will recursively scan deeper into directories it finds
Able to perform a list based or pure brute force scan
Custom HTTP headers can be added
Proxy support
Auto switching between HEAD and GET requests
Content analysis mode when failed attempts come back as 200
Performance can be adjusted while the program in running
Supports Basic, Digest and NTLM auth
Default file scanning with Nikto database

OWASP
5
When to use DirBuster

Black Box Application Assessment

Unidentified web servers during network

assessments

For very crude stress testing

OWASP
6
What vulnerabilities does it detect?

None!

OWASP
7
The Lists

Custom lists generated by finding what

developers actually use

How? Spider the internet

The lists are then ordered by frequency

DirBuster comes with 8 separate lists

OWASP
8
Explicit Words

This may surprise you, there is porn on the

internet

The spider visited a few

Is the inclusion of explicit words a problem?

If such words are present on commercial websites

I am 100% sure they would wish to know!

OWASP
9
When a 404 is not a 404!

Detecting 404 is not as simple as it appears!

404's that are returned as 200's

Static
Dynamic

Directories that return 403 for everything

Web servers that return different error pages

based on extension
OWASP
1
When a 404 is not a 404!

Trying to solve this problem

Base case for each dir and file ext
200's are normalised
If all else fails – regex

It's not perfect, but it's flexible enough to get

results 99% of the time

OWASP
1
Demo

OWASP
1
Summary

DirBuster is an offensive tool

Helps finds new attack vectors

Lots of features to help get accurate results

OWASP
1
Questions?

OWASP
1