Back to rankings

maurosoria/dirsearch

Python

Web path scanner

fuzzerfuzzingpythonsecuritydirsearchhackingpentestingpenetration-testingbug-bountyappsecwordlisthacking-tool
Star Growth
Stars
14.5k
Forks
2.4k
Weekly Growth
Issues
16
5k10k
May 2013Sep 2017Feb 2022Jul 2026
ArtifactsPyPIpip install dirsearch
README
dirsearch logo (light) dirsearch logo (dark)

dirsearch - Web Path Discovery

Build License Stars Release Sponsors Discord Twitter

An advanced web path brute-forcer

dirsearch is being actively developed by @maurosoria and @shelld3v.

Join the Discord server to communicate with the team.

Quick Start

dirsearch requires Python 3.11 or higher.

git clone https://github.com/maurosoria/dirsearch.git --depth 1
cd dirsearch
python3 dirsearch.py -u https://example.com -e php,html,js

You can also install the latest Python stack directly from GitHub with pip:

pip3 install git+https://github.com/maurosoria/dirsearch.git
dirsearch -u https://example.com -e php,html,js

The Rust native backend is opt-in for source installs; see Installation for the native build steps.

Pre-built PyInstaller binaries and portable folder archives are available on the Releases page.

Documentation

The full documentation now lives in docs/:

  • Installation: supported platforms, Python install, release artifacts, and Docker.
  • Usage Guide: common scans, recursion, filters, proxies, raw requests, reports, and tips.
  • Wordlists: %EXT%, categories, templates, prefixes, suffixes, and transformations.
  • CLI Options: complete command-line reference.
  • Configuration: config.ini reference.
  • Sessions: save, list, and resume scan sessions.
  • Python API: importable API examples.
  • Building: PyInstaller, portable builds, Docker images, and GitHub Actions.
  • References: external tutorials and articles.

Minimal Examples

python3 dirsearch.py -u https://target
python3 dirsearch.py -u https://target -e php,html,js
python3 dirsearch.py -u https://target -e php,html,js -w /path/to/wordlist
python3 dirsearch.py -u https://target -r --max-recursion-depth 3

Use python3 dirsearch.py -h for the full CLI help.

Python API

dirsearch can also be used from Python code for local automation, MCP servers, REST wrappers, and agent-controlled scans. The importable API keeps its configuration in FuzzerConfig, so callers do not need to parse CLI flags or mutate CLI globals.

See Python API for examples covering templates, custom wordlists, callbacks, authenticated sessions, and agent-oriented scan recipes.

Contributing

Pull requests and feature requests are welcome. See CONTRIBUTORS.md for the people who have helped improve dirsearch.

License

Copyright (C) Mauro Soria (maurosoria@gmail.com)

License: GNU General Public License, version 2.

Related repositories
ffuf/ffuf

Fast web fuzzer written in Go

GoGo ModulesMIT Licensefuzzerpentesting
16.4k1.6k
TheKingOfDuck/fuzzDicts

You Know, For WEB Fuzzing !

PythonPyPIfuzzingfuzz-testing
8.4k2.5k
AFLplusplus/AFLplusplus

The fuzzer afl++ is afl with community patches, qemu 5.1 upgrade, collision-free coverage, enhanced laf-intel & redqueen, AFLfast++ power schedules, MOpt mutators, unicorn_mode, and a lot more!

CGNU Affero General Public License v3.0aflafl-fuzz
aflplus.plus
6.7k1.3k
google/syzkaller

syzkaller is an unsupervised coverage-guided kernel fuzzer

GoGo ModulesApache License 2.0linuxkernel
6.3k1.4k
antonio-morales/Fuzzing101

An step by step fuzzing tutorial. A GitHub Security Lab initiative

Apache License 2.0fuzzingsecurity
securitylab.github.com
3.8k420
crytic/echidna

Ethereum smart contract fuzzer

HaskellGNU Affero General Public License v3.0evmethereum
secure-contracts.com/program-analysis/echidna/index.html
3.2k436
1N3/BlackWidow

A Python based web application scanner to gather OSINT and fuzz for OWASP vulnerabilities on a target website.

PythonPyPIOtherwebapplication
sn1persecurity.com
1.8k392
0vercl0k/wtf

wtf is a distributed, code-coverage guided, customizable, cross-platform snapshot-based fuzzer designed for attacking user and / or kernel-mode targets running on Microsoft Windows and Linux user-mode (experimental!).

C++MIT Licensefuzzersnapshot-fuzzer
1.8k153
Endava/cats

CATS is a REST API Fuzzer and negative testing tool for OpenAPI endpoints. CATS automatically generates, runs and reports tests with minimum configuration and no coding effort. Tests are self-healing and do not require maintenance.

JavaMavenApache License 2.0javaopenapi
1.4k89
m4n3dw0lf/pythem

pentest framework

PythonPyPIGNU General Public License v3.0pentestsniffer
1.3k321
CodeIntelligenceTesting/jazzer

Coverage-guided, in-process fuzzing for the JVM

JavaMavenApache License 2.0fuzzingjava
code-intelligence.com
1.2k169
wireghoul/dotdotpwn

DotDotPwn - The Directory Traversal Fuzzer

PerlGNU General Public License v3.0securityperl
dotdotpwn.blogspot.com
1.1k186