[Dhoroty]

This mini tutorial will help you find some hidden gems in a web server, that may come in handy.

There is a great tool for this task, called DirBuster. It is included in Kali Linux. This is designed to brute force web and application servers. The tool can brute force directories and files.

So if you start the app, you'll see a lot of options to play with.
If you're not a pro, who wants to tweak stuff, just enter the target URL and hit start.
Then It'll use a list, and the findings will shown to you.



Some options, you can tweak:
Number of threads. If you got a good internet connection, you can set it a bit up, if there is no defense on the server against brute forcing.

Scanning type. You can go with pre defined lists, or you can chose pure brute force. The last will give more result, but will took way longer.

Be Recursive. This option will let the app scan in subdirs like they were the root. This will took longer, but could give more results. I usually tick this in.

File extension. If you're looking for a specific stuff, you can filter for the extensions.

[Shisho]

DirBuster has not been updated in near to 7 years. How about recommending something more modern like Dirstalk?

[Dhoroty]

You're right.
Use dirstalk, this way:

Code

dirstalk scan http://someaddress.url/ --dictionary mydictionary.txt