# Dirsearch

> Use for web path and file enumeration during authorized pentests. Trigger on hidden endpoint discovery, lightweight content enumeration, and repeatable route checks against approved web targets.

- Skill: `timsonner/dirsearch` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/dirsearch`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/dirsearch/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/dirsearch

---


# Dirsearch

## Purpose

Use this skill for lightweight directory and file enumeration when a simple CLI workflow is sufficient.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Retest and Closure

## Use When

- Need quick content discovery on confirmed web targets.
- Need to check a narrow route set without deeper recursion.
- Need a repeatable path enumeration workflow for retest.

## Avoid When

- The target is fragile or rate-sensitive.
- Broad or recursive enumeration is not justified by the phase objective.

## Inputs

- Confirmed base URL
- Wordlist or extension list
- Thread count, status filters, and exclusions

## Procedure

1. Start with the smallest wordlist that fits the hypothesis.
2. Filter noise aggressively and review only meaningful responses.
3. Separate authenticated from unauthenticated coverage.
4. Hand material hits to manual validation.
5. Preserve the path set and options for retest.

## Command Syntax

Replace sample targets with approved in-scope assets.

```bash
# Basic scan with common extensions
dirsearch -u https://portal.contoso.com -e php,aspx,html,txt

# Custom wordlist with multiple extensions
dirsearch -u https://portal.contoso.com -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt -e php,aspx

# Exclude specific response codes
dirsearch -u https://portal.contoso.com -w paths.txt -x 403,404

# Output to file
dirsearch -u https://portal.contoso.com -e php,aspx -o contoso-dirsearch.txt

# Authenticated scan with session cookie
dirsearch -u https://portal.contoso.com -e php -H "Cookie: session=<token>"

# Recursive scan to max depth 3
dirsearch -u https://portal.contoso.com -e php,aspx -r --max-recursion-depth 3

# Throttle with delay to avoid triggering WAF
dirsearch -u https://portal.contoso.com -e php --delay 0.5
```

## Evidence to Capture

- New paths or files confirmed to exist
- Response patterns that indicate hidden functionality
- Exact options used during the run

## Safety Boundaries

- Keep requests low impact and aligned to approved scope.
- Stop if the application shows instability or rate-limit triggers.