Ultimate Dirsearch Cheat Sheet

A reference guide for the advanced web path scanner. Find hidden directories and files fast.

Jump To Section

• Basic Syntax
• Wordlists & Extensions
• Filtering & Status Codes
• Advanced Features
• Performance Tuning
• Output & Reports

1. Basic Syntax

The fundamental structure of a Dirsearch command.

dirsearch -u [URL] [options]

Essential Flags

• -u, --url [URL] : Target URL
• -w, --wordlist [FILE] : Wordlist path
• -e, --extensions [EXT] : File extensions
• -t, --threads [N] : Thread count

Basic Scan

• dirsearch -u http://example.com : Default scan
• dirsearch -u https://example.com -w wordlist.txt : Custom wordlist
• dirsearch -u http://example.com -e php : PHP files
• dirsearch -u http://example.com -t 50 : 50 threads

Pro Tip: Default Wordlist
Dirsearch uses db/dicc.txt by default. For better results, use SecLists or custom wordlists with -w /path/to/wordlist.txt.

2. Wordlists & Extensions

Custom Wordlist

Specify a custom wordlist for directory/file discovery.

dirsearch -u http://example.com -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-directories.txt

Multiple Extensions

Test multiple file extensions simultaneously.

dirsearch -u http://example.com -e php,html,txt,js,json

Force Extensions

Force extensions on every word in wordlist.

dirsearch -u http://example.com -w words.txt -f -e .php,.bak,.old

Lowercase Wordlist

Convert all words to lowercase.

dirsearch -u http://example.com -w words.txt --lowercase

Capitalize Words

Capitalize first letter of each word.

dirsearch -u http://example.com -w words.txt --capitalize

Wordlist Flag	Description
-w, --wordlist	Path to wordlist file
-e, --extensions	File extensions to test
-f, --force-extensions	Force extensions on all words
--lowercase	Convert words to lowercase
--capitalize	Capitalize first letter
--uppercase	Convert words to uppercase

3. Filtering & Status Codes

Exclude Status Codes

Hide specific HTTP status codes from results.

dirsearch -u http://example.com -x 404,500,502

Include Status Codes

Show only specific HTTP status codes.

dirsearch -u http://example.com -i 200,301,302,403

Exclude by Size

Hide responses with specific content length.

dirsearch -u http://example.com --exclude-sizes=0B,1234B

Exclude by Text

Hide responses containing specific text.

dirsearch -u http://example.com --exclude-texts="Not Found,Error"

Exclude by Regex

Hide responses matching regex pattern.

dirsearch -u http://example.com --exclude-regex="^404$"

Filter Flag	Description
-x, --exclude	Exclude status codes
-i, --include	Include only status codes
--exclude-sizes	Exclude by response size
--exclude-texts	Exclude by text content
--exclude-regex	Exclude by regex pattern
--exclude-redirects	Exclude redirect responses

4. Advanced Features

Recursive Scanning

Scan discovered directories recursively.

dirsearch -u http://example.com -r

Deep Recursive

Set maximum recursion depth.

dirsearch -u http://example.com -r -R 5

Custom Headers

Add custom headers for authenticated scanning.

dirsearch -u http://example.com -H "Authorization: Bearer TOKEN123" -H "Cookie: session=abc"

Custom User Agent

Set custom user agent string.

dirsearch -u http://example.com --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

Random User Agent

Use random user agents from file.

dirsearch -u http://example.com --random-agent

Proxy Support

Route traffic through proxy.

dirsearch -u http://example.com --proxy=http://127.0.0.1:8080

HTTPS Certificate Handling

Skip SSL certificate verification.

dirsearch -u https://example.com --no-check-certificate

IP Scan

Scan IP instead of resolving domain.

dirsearch -u http://example.com --ip=192.168.1.10

Pro Tip: Recursive with Depth
Use -r -R 3 for controlled recursion. Too deep recursion can generate massive amounts of requests and take hours to complete.

5. Performance Tuning

Thread Control

Increase threads for faster scanning.

dirsearch -u http://example.com -t 100

Timeout Configuration

Set timeout for slow servers.

dirsearch -u http://example.com --timeout=10

Delay Between Requests

Add delay to avoid rate limiting.

dirsearch -u http://example.com --delay=0.5

Retry Failed Requests

Retry failed requests automatically.

dirsearch -u http://example.com --retries=3

Max Request Rate

Limit requests per second.

dirsearch -u http://example.com --max-rate=100

Persistent Connection

Use HTTP keep-alive connections.

dirsearch -u http://example.com --persistent

Performance Flag	Description
-t, --threads [N]	Number of threads (default 20)
--timeout [SEC]	Request timeout (default 10)
--delay [SEC]	Delay between requests
--retries [N]	Retry failed requests
--max-rate [N]	Max requests per second
--persistent	Keep connections alive

Warning:

High thread counts (-t 200) can cause false positives and trigger WAF blocks. Use --delay and --max-rate for stealth scanning on sensitive targets.

6. Output & Reports

Simple Output

Save results to a plain text file.

dirsearch -u http://example.com -o results.txt

JSON Report

Export results in JSON format.

dirsearch -u http://example.com --json-report=results.json

XML Report

Export results in XML format.

dirsearch -u http://example.com --xml-report=results.xml

CSV Report

Export results in CSV format.

dirsearch -u http://example.com --csv-report=results.csv

Markdown Report

Export results in Markdown format.

dirsearch -u http://example.com --markdown-report=results.md

Silent Mode

Output only results, no banners.

dirsearch -u http://example.com --quiet

Full Report

Generate all report formats at once.

dirsearch -u http://example.com --json-report=results.json --xml-report=results.xml --csv-report=results.csv

Output Flag	Description
-o, --output [FILE]	Plain text output
--json-report [FILE]	JSON format report
--xml-report [FILE]	XML format report
--csv-report [FILE]	CSV format report
--markdown-report [FILE]	Markdown report
--quiet	Silent output mode

Pro Tip: Multiple Reports
Generate multiple report formats simultaneously for different use cases - JSON for automation, CSV for spreadsheet analysis, and plain text for quick review.

⇧