godirb

godirb

godirb is a fast recursive directory/file brute-forcer written in Go.

It is for the moments where you want a modern dirb-like tool: run it, get useful results, tune the obvious flags, and avoid dragging a full fuzzing framework into a simple job.

godirb vs DirSearch

DirSearch is a mature web path scanner. godirb is smaller on purpose.

Features

• Embedded wordlists: small, common, medium, big, ports, payloads, xss, lfi
• Default wordlist: medium
• Recursive mode with -r, --recursive
• Extensions with -x, --ext
• Threads with -t, --threads (default: 15)
• Ignore status codes with -i, --ignore (default: 404,400,405,408)
• Wildcard detection for directory scans
• Text, quiet text, JSON, CSV and file output

Install

go install github.com/MyCode83/godirb@latest

Or download a binary from Releases, or build it:

git clone https://github.com/MyCode83/godirb.git
cd godirb
go build -o godirb .

Usage

godirb -u http://localhost
godirb -u http://localhost -r
godirb -u http://localhost -w ./paths.txt
godirb -u http://localhost -t 30
godirb -u http://localhost -i 404,403,500
godirb -u http://localhost -x php,txt,bak

FUZZ in the URL switches to placeholder mode:

godirb -u "http://localhost/search?q=FUZZ" -w payloads
godirb -u http://localhost:FUZZ

Output

[DIR] http://localhost/admin ---> 200 | 1234

godirb -u http://localhost --json -o results.json
godirb -u http://localhost --csv -o results.csv
godirb -u http://localhost -q

Disclaimer

Use godirb only for authorized testing, labs and CTFs. You are responsible for having permission to scan a target.

License

MIT. See LICENSE.