How do I reduce false positives in dirsearch?

Filter with --include-status and --exclude-status, drop noisy sizes with --exclude-sizes, or exclude pages that resemble a known 404 with --exclude-response. --exclude-text and --exclude-regex prune hits by body content.

Can dirsearch scan recursively?

Yes. --recursive brute-forces the directories it discovers, --deep-recursive recurses on every path depth, and --max-recursion-depth bounds how deep it goes. Restrict recursion to certain codes with --recursion-status.

Can dirsearch scan behind authentication?

Yes. Pass --cookie or --header for session data, or --auth with --auth-type (basic, digest, bearer, ntlm, jwt), and route through --proxy to reach a logged-in or intercepted target.

When should I use dirsearch instead of ffuf?

Use dirsearch when the job is path discovery with status, size, and recursion controls plus report --format options. Use ffuf when you need a general FUZZ engine across paths, parameters, and vhosts.

Updated Jul 14, 2026

Discovery

Brute-force hidden web paths on live hosts

Web path scanner.

Find hidden directories and files Scope results with status and size filters Walk an application tree recursively

overview

What dirsearch does

After httpx confirms a host is live, dirsearch takes --url and --wordlists and requests every path candidate. Hits become a path list for a crawler or scanner.

Operators reach for it when navigation and crawls miss admin panels, backups, .git, and config files. --extensions expands entries; --force-extensions appends to every word.

Soft-404 noise is the failure mode: keep codes with --include-status, drop with --exclude-status, or prune sizes via --exclude-sizes. --recursive walks directories it finds. Prefer ffuf for parameter or vhost FUZZ; prefer katana when you want crawl-found links, not guesses.

source github.com/maurosoria/dirsearch

use cases

Where dirsearch fits

Find hidden directories and files

Brute-force a live host with a content wordlist and extension list to surface admin panels, backups, and endpoints missing from the site's navigation.

Scope results with status and size filters

Include only interesting status codes and exclude noisy sizes or redirect targets so the output is real hits, not soft-404 padding.

Walk an application tree recursively

Enable recursive brute-forcing to descend into discovered directories and map deeper paths automatically.

Scan authenticated or proxied targets

Pass cookies, headers, or an auth credential and route through a proxy to discover content behind a login or through an intercepting tool.

reference

dirsearch inputs and flags

70 inputs

Name	Type	Flag	Description
url	STRING	--url	Target URL(s), can use multiple flags.
wordlist	FILE	--wordlists	Wordlist file of paths to brute-force.
extensions	STRING	--extensions	Extension list separated by commas (e.g. php,asp).
recursive	BOOLEAN	--recursive	Brute-force recursively into discovered directories.
include-status	STRING	--include-status	Include status codes, supports ranges (e.g. 200,300-399).
exclude-status	STRING	--exclude-status	Exclude status codes, supports ranges (e.g. 301,500-599).
format	STRING	--format	Report format (simple, plain, json, xml, md, csv, html, sqlite, and more).
threads	STRING	--threads	Number of threads for concurrent requests.

Showing key inputs. dirsearch exposes 70 inputs in total.

Full flag reference (70 inputs)

Name	Type	Flag	Description
ip	STRING	--ip	Server IP address
raw	FILE	--raw	Load raw HTTP request from file (use '--scheme' flag to set the scheme)
tor	BOOLEAN	--tor	Use Tor network as proxy
url	STRING	--url	Target URL(s), can use multiple flags
auth	STRING	--auth	Authentication credential (e.g. user:password or bearer token)
cidr	STRING	--cidr	Target CIDR
data	STRING	--data	HTTP request data
crawl	BOOLEAN	--crawl	Crawl for new paths in responses
delay	STRING	--delay	Delay between requests
proxy	STRING	--proxy	Proxy URL (HTTP/SOCKS), can use multiple flags
config	FILE	--config	Path to configuration file
cookie	STRING	--cookie	Cookie
format	STRING	--format	Report format (Available: simple,plain,json,xml,md,csv,html,sqlite,mysql,postgresql)
header	STRING	--header	HTTP request header, can use multiple flags
scheme	STRING	--scheme	Scheme for raw request or if there is no scheme in the URL (Default: auto-detect)
capital	BOOLEAN	--capital	Capital wordlist
retries	STRING	--retries	Number of retries for failed requests
session	FILE	--session	Session file
subdirs	STRING	--subdirs	Scan sub-directories of the given URL[s] (separated by commas)
threads	STRING	--threads	Number of threads
timeout	STRING	--timeout	Connection timeout
full-url	BOOLEAN	--full-url	Full URLs in the output (enabled automatically in quiet mode)
key-file	FILE	--key-file	File contains client-side certificate private key (unencrypted)
max-rate	STRING	--max-rate	Max requests per second
max-time	STRING	--max-time	Maximum runtime for the scan
no-color	BOOLEAN	--no-color	No colored output
prefixes	STRING	--prefixes	Add custom prefixes to all wordlist entries (separated by commas)
suffixes	STRING	--suffixes	Add custom suffixes to all wordlist entries, ignore directories (separated by commas)
wordlist	FILE	--wordlists	Wordlist file
auth-type	STRING	--auth-type	Authentication type (basic, digest, bearer, ntlm, jwt)
cert-file	FILE	--cert-file	File contains client-side certificate
data-file	FILE	--data-file	File contains HTTP request data
interface	STRING	--interface	Network interface to use
lowercase	BOOLEAN	--lowercase	Lowercase wordlist
recursive	BOOLEAN	--recursive	Brute-force recursively
uppercase	BOOLEAN	--uppercase	Uppercase wordlist
urls-file	FILE	--urls-file	URL list file
wordlists	FOLDER	--wordlists	Wordlists folder
extensions	STRING	--extensions	Extension list separated by commas (e.g. php,asp)
proxy-auth	STRING	--proxy-auth	Proxy authentication credential
quiet-mode	BOOLEAN	--quiet-mode	Quiet mode
user-agent	STRING	--user-agent	User agent
http-method	STRING	--http-method	HTTP method (default: GET)
nmap-report	FILE	--nmap-report	Load targets from nmap report (Ensure the inclusion of the -sV flag during nmap scan for comprehensive results)
exclude-text	STRING	--exclude-text	Exclude responses by text, can use multiple flags
headers-file	BOOLEAN	--headers-file	File contains HTTP request headers
proxies-file	FILE	--proxies-file	File contains proxy servers
random-agent	BOOLEAN	--random-agent	Choose a random User-Agent for each request
replay-proxy	STRING	--replay-proxy	Proxy to replay with found paths
exclude-regex	STRING	--exclude-regex	Exclude responses by regular expression
exclude-sizes	STRING	--exclude-sizes	Exclude responses by sizes, separated by commas (e.g. 0B,4KB)
exit-on-error	BOOLEAN	--exit-on-error	Exit whenever an error occurs
deep-recursive	BOOLEAN	--deep-recursive	Perform recursive scan on every directory depth (e.g. api/users -> api/)
exclude-status	STRING	--exclude-status	Exclude status codes, separated by commas, support ranges (e.g. 301,500-599)
include-status	STRING	--include-status	Include status codes, separated by commas, support ranges (e.g. 200,300-399)
skip-on-status	STRING	--skip-on-status	Skip target whenever hit one of these status codes, separated by commas, support ranges
exclude-subdirs	STRING	--exclude-subdirs	Exclude the following subdirectories during recursive scan (separated by commas)
force-recursive	BOOLEAN	--force-recursive	Do recursive brute-force for every found path, not only directories
exclude-redirect	STRING	--exclude-redirect	Exclude responses if this regex (or text) matches redirect URL (e.g. '/index.html')
exclude-response	STRING	--exclude-response	Exclude responses similar to response of this page, path as input (e.g. 404.html)
follow-redirects	BOOLEAN	--follow-redirects	Follow HTTP redirects
force-extensions	BOOLEAN	--force-extensions	Add extensions to the end of every wordlist entry. By default dirsearch only replaces the %EXT% keyword with extensions
recursion-status	STRING	--recursion-status	Valid status codes to perform recursive scan, support ranges (separated by commas)
max-response-size	STRING	--max-response-size	Maximum response length
min-response-size	STRING	--min-response-size	Minimum response length
redirects-history	BOOLEAN	--redirects-history	Show redirects history
remove-extensions	BOOLEAN	--remove-extensions	Remove extensions in all paths (e.g. admin.php -> admin)
exclude-extensions	STRING	--exclude-extensions	Exclude extension list separated by commas (e.g. asp,jsp)
max-recursion-depth	STRING	--max-recursion-depth	Maximum recursion depth
overwrite-extensions	BOOLEAN	--overwrite-extensions	Overwrite other extensions in the wordlist with your extensions (selected via `-e`)

example

Run dirsearch

dirsearch · command

# brute-force a live host, recurse, filter noise, JSON reportdirsearch -u https://example.com -w /wordlists/content.txt -e php,asp,json -r -i 200,301,403 -x 404 --format json

sample output

Target: https://example.com/ [13:24:05] Starting: [13:24:11] 301 -   178B  - /admin  ->  https://example.com/admin/[13:24:13] 200 -     4KB  - /admin/login.php[13:24:19] 403 -   279B  - /.git/HEAD[13:24:26] 200 -    12KB  - /backup.zip[13:24:31] 200 -     1KB  - /config.php.bak[13:24:44] 301 -   178B  - /api  ->  https://example.com/api/[13:24:52] 200 -     2KB  - /robots.txt Task Completed

guidance

Choosing dirsearch

Use dirsearch on a host you already know is live when you need path brute-force with status and size filters. Reach for ffuf when you need a general FUZZ engine across parameters or vhosts. Use katana when discovery should follow links rather than guess them.

ffuf

General FUZZ engine for paths, parameters, and vhosts. dirsearch is purpose-built for path discovery with built-in report formats.

feroxbuster

Recursive content discovery with smart defaults. dirsearch offers richer include and exclude filtering.

gobuster

Fast, simple directory brute-forcing. dirsearch adds recursion control and more output formats.

faq

dirsearch questions

--extensions takes a comma-separated list such as php,asp,json and substitutes the %EXT% keyword in wordlist entries. Add --force-extensions to append them to every entry, or --overwrite-extensions to replace extensions already in the wordlist.

Run dirsearch yourself

A live URL and a wordlist feed dirsearch, which brute-forces paths and writes the discovered files and directories as a queryable output.

Open dirsearch in the library Build a workflow with it

Facts on this page come from the live Trickest tool library.

Brute-force hidden web paths on live hosts

What dirsearch does

Where dirsearch fits

Find hidden directories and files

Scope results with status and size filters

Walk an application tree recursively

Scan authenticated or proxied targets

dirsearch inputs and flags

Run dirsearch

Choosing dirsearch

ffuf

feroxbuster

gobuster

dirsearch questions

More Discovery tools

apkurlgrep

cariddi

crawlergo

fallparams

feroxbuster

gau

Run dirsearch yourself