Project Name | Stars | Downloads | Repos Using This | Packages Using This | Most Recent Commit | Total Releases | Latest Release | Open Issues | License | Language |
---|---|---|---|---|---|---|---|---|---|---|
Trivy | 16,750 | 25 | 4 hours ago | 176 | September 16, 2022 | 385 | apache-2.0 | Go | ||
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more | ||||||||||
Bettercap | 13,764 | 14 days ago | 61 | April 21, 2021 | 146 | other | Go | |||
The Swiss Army knife for 802.11, BLE, IPv4 and IPv6 networks reconnaissance and MITM attacks. | ||||||||||
Nuclei | 12,286 | 4 | 7 hours ago | 353 | August 26, 2022 | 167 | mit | Go | ||
Fast and customizable vulnerability scanner based on simple YAML based DSL. | ||||||||||
Routersploit | 10,942 | 6 months ago | 98 | other | Python | |||||
Exploitation Framework for Embedded Devices | ||||||||||
Vuls | 9,873 | a day ago | 142 | September 02, 2022 | 80 | gpl-3.0 | Go | |||
Agent-less vulnerability scanner for Linux, FreeBSD, Container, WordPress, Programming language libraries, Network devices | ||||||||||
Awesome Security | 9,606 | 10 days ago | 18 | mit | ||||||
A collection of awesome software, libraries, documents, books, resources and cools stuffs about security. | ||||||||||
Rustscan | 9,432 | 25 days ago | 17 | April 27, 2022 | 117 | gpl-3.0 | Rust | |||
🤖 The Modern Port Scanner 🤖 | ||||||||||
Dirsearch | 9,386 | 21 days ago | 6 | June 17, 2021 | 47 | Python | ||||
Web path scanner | ||||||||||
Tsunami Security Scanner | 7,808 | 4 | 6 days ago | 14 | August 01, 2022 | 37 | apache-2.0 | Java | ||
Tsunami is a general purpose network security scanner with an extensible plugin system for detecting high severity vulnerabilities with high confidence. | ||||||||||
Wpscan | 7,433 | a day ago | 50 | other | Ruby | |||||
WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites. Contact us via [email protected] |
Dirstalk is a multi threaded application designed to brute force paths on web servers.
The tool contains functionalities similar to the ones offered by dirbuster and dirb.
Here you can see it in action:
The application is self-documenting, launching dirstalk -h
will return all the available commands with a
short description, you can get the help for each command by doing distalk <command> -h
.
EG dirstalk result.diff -h
To perform a scan you need to provide at least a dictionary and a URL:
dirstalk scan http://someaddress.url/ --dictionary mydictionary.txt
As mentioned before, to see all the flags available for the scan command you can
just call the command with the -h
flag:
dirstalk scan -h
dirstalk scan http://someaddress.url/ \
--dictionary mydictionary.txt \
--http-methods GET,POST \
--http-timeout 10000 \
--scan-depth 10 \
--threads 10 \
--socks5 127.0.0.1:9150 \
--cookie name=value \
--use-cookie-jar \
--user-agent my_user_agent \
--header "Authorization: Bearer 123"
--cookie stringArray cookie to add to each request; eg name=value (can be specified multiple times)
-d, --dictionary string dictionary to use for the scan (path to local file or remote url)
--header stringArray header to add to each request; eg name=value (can be specified multiple times)
-h, --help help for scan
--http-cache-requests cache requests to avoid performing the same request multiple times within the same scan (EG if the server reply with the same redirect location multiple times, dirstalk will follow it only once) (default true)
--http-methods strings comma separated list of http methods to use; eg: GET,POST,PUT (default [GET])
--http-statuses-to-ignore ints comma separated list of http statuses to ignore when showing and processing results; eg: 404,301 (default [404])
--http-timeout int timeout in milliseconds (default 5000)
--out string path where to store result output
--scan-depth int scan depth (default 3)
--socks5 string socks5 host to use
-t, --threads int amount of threads for concurrent requests (default 3)
--use-cookie-jar enables the use of a cookie jar: it will retain any cookie sent from the server and send them for the following requests
--user-agent string user agent to use for http requests
docker run -d -p 127.0.0.1:9150:9150 stefanoj3/tordock:latest
and then when launching a
scan specify the following flag: --socks5 127.0.0.1:9150
)Dirstalk can also produce it's own dictionaries, useful for example if you want to check if a specific set of files is available on a given web server.
dirstalk dictionary.generate /path/to/local/files --out mydictionary.txt
The result will be printed to the stdout if no out flag is specified.
You can download a release from here
or you can use a docker image. (eg docker run stefanoj3/dirstalk dirstalk <cmd>
)
If you are using an arch based linux distribution you can fetch it via AUR: https://aur.archlinux.org/packages/dirstalk/
Example:
yay -S aur/dirstalk
All you need to do local development is to have make and golang available and the GOPATH correctly configured.
Then you can just clone the project, enter the folder and:
make dep # to fetch dependencies
make tests # to run the test suite
make check # to check for any code style issue
make fix # to automatically fix the code style using goimports
make build # to build an executable for your host OS (not tested under windows)
make help
will print a description of every command available in the Makefile.
Wanna add a functionality? fix a bug? fork and create a PR.