Dirmap is a web directory and file scanning tool designed for penetration testing that performs concurrent scanning across multiple targets and payloads simultaneously.
The tool addresses the need for comprehensive web reconnaissance by combining multiple scanning approaches in a single utility. It supports dictionary-based scanning, pure brute-force attacks with custom character sets, dynamic dictionary generation through web crawling, and fuzzing with custom tags applied to target URLs. The concurrent engine allows it to scan multiple targets against multiple payloads at once, with results automatically deduplicated and saved by domain name.
Dirmap suits penetration testers and security researchers who need flexible, multi-faceted directory discovery. The tool is particularly valuable for those requiring recursive scanning with customizable status codes, the ability to handle false positive 404 pages through regex matching, and fine-grained control over request behavior including custom User-Agent headers, random delays, timeouts, and proxy configuration. Configuration is file-based through a dirmap.conf file rather than command-line parameters, which allows detailed customization but requires editing configuration files rather than passing arguments directly.
The project shows active development with recent updates to core functionality and configuration handling. Work has focused on implementing the concurrent scanning engine and expanding the range of customization options available to users. The tool remains under active refinement with planned enhancements documented in the project roadmap.
