dirsearch is a web path scanner that brute-forces directories and files on web servers to discover hidden or non-obvious paths.
The tool addresses the need to enumerate web application structure during security assessments and bug bounty work. It operates by sending requests to a target URL with wordlist-generated path candidates, analyzing HTTP responses to identify valid endpoints. The scanner supports recursive discovery, allowing it to explore deeper into discovered directory structures, and provides filtering capabilities to refine results based on response characteristics.
Developers conducting penetration tests, bug bounty hunting, or security assessments should consider dirsearch when they need to systematically discover web paths. The tool suits projects requiring comprehensive web application reconnaissance. It offers a Python API for programmatic use, enabling integration into automation workflows, MCP servers, REST wrappers, and agent-controlled scans without requiring CLI flag parsing. The tool supports wordlist customization with template expansion, prefix and suffix transformations, and category-based word selection. It can handle authenticated sessions, proxy configuration, and raw HTTP request input for complex scenarios.
The project maintains active development with regular updates and documentation covering installation across multiple platforms including Docker, PyInstaller binaries, and portable archives. The team operates a Discord server for community communication and accepts pull requests and feature requests from contributors. The tool provides both a command-line interface with extensive options and an importable Python API that maintains configuration through a FuzzerConfig object, supporting local automation and agent-oriented scan recipes.
