Download DirBuster – Web Directory and File Brute Force Scanner

DirBuster is an open-source Java-based web security tool developed by OWASP that performs brute-force discovery of directories and files on web servers. By sending a large number of HTTP requests using customizable wordlists, DirBuster helps penetration testers and security administrators uncover hidden paths, backup files, admin panels, and other unlinked resources that may represent security risks.

Originally developed under the OWASP project, DirBuster has become a staple in web application security assessments. It supports multi-threaded scanning for speed, recursive directory discovery, and multiple request methods including GET and HEAD. Its graphical interface makes it accessible to both beginners and experienced security professionals.

DirBuster ships with extensive built-in wordlists covering common directory and file naming patterns, and supports custom user-supplied lists for targeted assessments. Results are displayed in real time in a tree view, showing the HTTP status codes, response sizes, and discovered paths.

Key Features

• Brute-force discovery of hidden directories and files on HTTP and HTTPS web servers.
• Multi-threaded engine for high-speed scanning with configurable thread count.
• Recursive scanning to discover nested subdirectories automatically.
• Supports GET and HEAD request methods for stealth scanning.
• Comes with OWASP-curated wordlists; also supports custom wordlist import.
• Real-time results tree showing HTTP status codes and response sizes per path.
• Pure Java implementation — runs on Windows, Linux, and macOS with Java installed.

How to Install

1. Ensure Java Runtime Environment (JRE) 8 or later is installed on your system.
2. Download the DirBuster JAR file from the link below.
3. Open a terminal and run: java -jar DirBuster-*.jar
4. In the GUI, enter the target URL, select a wordlist, configure threads, and click Start.
5. Monitor results in the tree view and export findings when the scan is complete.