> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/introduction-to-the-web-and-http-protocol/directory-enumeration.md). # Directory Enumeration ### Directory Enumeration with Gobuster * Gobuster is like dirb and dirbuster, its written in GO language, which enumerate directories in a website. ``` gobuster dir -u http:// -w /usr/share/wordlists/dirb/common.txt ``` * filtering the output ``` gobuster dir -u http:// -w /usr/share/wordlists/dirb/common.txt -b 403,404 ``` * check files ``` gobuster dir -u http:// -w /usr/share/wordlists/dirb/common.txt -b 403,404 -x .php,.xml,.txt, -r ``` * for sub-directory ``` gobuster dir -u http://// -w /usr/share/wordlists/dirb/common.txt -b 403,404 -x .php,.xml,.txt, -r ``` *** ### Directory Enumeration with BurpSuite When we start working with BurpSuite, we can just stay in that environment, if we are going to do web app penetration testing. * start the burpsuite and turn on the proxyfoxy * browse to login page * send the intercepted request to intruder and clear over the positions. Add near GET /$name$ * change the attack type to Sniper. * Intruder > Payloads > Payload Options (Simple List) and add a wordlist for directory enumeration like dirb/common.txt ***