[Blu3Dream]

Hey I would like to ask if there is any good toll that can find the finding directories of a website.

[f1re_w1re]

Hey I would like to ask if there is any good toll that can find the finding directories of a website.

The OWASP ZAP tool is probably one of the best tools there is:

https://www.owasp.org/index.php/OWASP_Ze...xy_Project

[PerfectStorm]

The OWASP ZAP tool is probably one of the best tools there is:

https://www.owasp.org/index.php/OWASP_Ze...xy_Project

Vouch OWASP ZAP in Kali it is great for such tasks.

[whiter0x]

What you are looking for is something called a "crawler".

http://www.hackingarticles.in/5-ways-crawl-website/

---

(If you don't like links, here is what to type into terminal)

msfconsole

use auxiliary/crawler/msfcrawler
set rhosts www.example.com < enter the website you wish to crawl
exploit

This will "crawl" the website and reveal as many links as it can.

[CyberStrike]

Spidering/crawling tends to lead to bad things, for example your IP is blocked because the spidering is requesting too much. Second improper controls, it stumbles into an admin page .. deletes users or the db.

[Instinct777]

DirBuster from Kali linux is very good. Just search on google fiind directories dir buster and u will fiind the answer.

[whiter0x]

Spidering/crawling tends to lead to bad things, for example your IP is blocked because the spidering is requesting too much. Second improper controls, it stumbles into an admin page .. deletes users or the db.

True, but idk about the deletion lol. But youre right about the first part.

[CyberStrike]

True, but idk about the deletion lol. But youre right about the first part.

So if the crawler stumbled upon a link to drop the db would the crawler navigate to that uri?

[f1re_w1re]

With all due respect and civil discourse, i also disagree. I never heard or seen a crawler that dropped a database. Crawlers just index. If that were the case, Google would be responsible for the dysfunctionally of many servers on the web. I suppose this could be possible in really antiquated systems, but i dont think this is something that someone should heed when crawling sites. If devs are putting link on their sites (or robots files) that link to a URI to drop a database, then there are bigger issues in terms of security. I dont think sites like these can exist for long and if youre a dev, youre going to know better.

[V3N0M]

Any webscrawler will get the job done

[diastolik]

so this OWASP ZAP displays directories of a website for you?
like a file viewer?
is my understanding on this correct?