4

I'm looking for a tool which can scan all possible filename combinations on a server and tells you what filenames the server responded to.

So it would try something like: example.com/a, example.com/b, ... , example.com/css, ... .

It would the check if the answer from the server is a 403 or something like that and try the next one.

Stevoisiak
  • 1,515
  • 1
  • 11
  • 27
Max Rumpf
  • 43
  • 1
  • 1
  • 3

3 Answers3

3

Check out DirBuster where you can feed wordlists and it'll try to brute force file and directory names.

Nikto also checks for commonly used folder and file names on a web server.

It is not possible to check every file and folder name, however running the above tools will give you a decent amount of enumeration.

SilverlightFox
  • 33,408
  • 6
  • 67
  • 178
1

In addition to DirBuster and Nikto already mentioned, Nmap has several NSE scripts that could help with this and similar tasks:

  • http-enum - Makes lots of requests for common directories, files, and other goodies. It can also use Nikto's database to perform most of the same checks.
  • http-config-backup - Checks for accessible config files for various frameworks, including backup extensions and editor swap files.
  • http-userdir-enum - Enumerates usernames used with Apache's mod_userdir or similar extensions. Most of the time, these are valid URLs, too.
  • http-favicon - Retrieves the favicon.ico of the target and compares it to a list of known icons to determine server or web framework.
  • http-waf-fingerprint - Detects and fingerprints different Web Application Firewalls (WAFs) based on their modification of requests and responses.
  • http-php-version - Determines the version of PHP running on the target using easter-egg requests.
  • http-default-accounts - Attempts to log in to various devices and frameworks with default credentials.

There are many more, including enumerators for WordPress plugins, Drupal modules, IIS short file names (8.3), Gitweb projects, etc.

To be fair, most dedicated web scanners will have similar functionality built in: w3af, Netsparker, Burp Suite, and others.

bonsaiviking
  • 11,316
  • 1
  • 27
  • 50
0

URL Fuzzer might do what you're looking for. It's a web app that can scan any URL for accessible directories or files with a specified extension. Do note that you can only do a limited amount of scans for free.

Stevoisiak
  • 1,515
  • 1
  • 11
  • 27