## Gobuster
* A directory and file brute-forcing tool used to find hidden files, directories, and subdomains on websites
* It operates by sending HTTP requests based on a wordlist and identifying resources that are not publicly linked but still accessible
### Commands
* Installation
{% code overflow="wrap" lineNumbers="true" %}
```bash
sudo apt install gobuster
```
{% endcode %}
***
* Scan
{% code overflow="wrap" lineNumbers="true" %}
```bash
gobuster -u $URL #Scan url
gobuster -u $url -w $wordlist #Specify wordlist path
gobuster dir -u $url -w $wordlist #Directory and file mode
gobuster dns -u $url -w $wordlist #For DNS enumeration
gobuster vhost -u $url -w $wordlist #Subdomain mode
gobuster vhost -u $url -w $wordlist --append-domain #To set de subdomain first
```
{% endcode %}
{% hint style="warning" %}
Remember that when using the `vhost` option, you have to have the domain IP on the list of known hosts
{% endhint %}
## ffuf
* Flexible and fast web fuzzing tool used for brute-forcing directories, files, subdomains, and more
### Commands
* Installation
{% code overflow="wrap" lineNumbers="true" %}
```bash
sudo apt install ffuf
```
{% endcode %}
***
* Scan
{% code overflow="wrap" lineNumbers="true" %}
```bash
ffuf -u $URL/FUZZ -w $wordlist #FUZZ to fill the part to be fuzz
ffuf -u $URL/FUZZ -w $wordlist -o $filename #get output in a file
```
{% endcode %}
{% hint style="info" %}
**Note:** Optional keywords can be added after `$wordlist` separating them with `,`
{% endhint %}
## dirb
* Web content scanner that automates the task of discovering hidden directories and files on a web server by brute-forcing URL paths using a wordlist
### Commands
* Installation
{% code overflow="wrap" lineNumbers="true" %}
```bash
sudo apt install dirb
```
{% endcode %}
***
* Scan
dirb $URL #Scan URL
dirb $URL $wordlist #Use wordlist
dirb $URL $wordlist -w #Ignore warning messages
dirb $URL $wordlist -u $username:$password #Use
dirb $URL $wordlist -E $certificate #Use certificate
## Nikto
* A tool for scanning vulnerabilities of websites
### Commands
* Installation
{% code overflow="wrap" lineNumbers="true" %}
```bash
sudo apt install nikto
```
{% endcode %}
***
* Usage
{% code overflow="wrap" lineNumbers="true" %}
```bash
nikto -h $host #Scan a website
nikto -h $host -ssl #Scan a website using HTTPS
nikto -h $IPtxtFile #Scan all directions from a text file
nikto -h $host -o $outFile #Output results to a file
nikto -h $host -o $outFile -Format $format #Indicate format of the output
nikto -h $host -Tuning b #Just run fingerprinting modules
```
{% endcode %}
## Payload Box
* GitHub repository with payloads for different web application attacks
*
## Feroxbuster
* A directory and file brute-forcing tool (fuzzer) written in *Rust*
### Commands
* Installation
{% code overflow="wrap" lineNumbers="true" %}
```bash
sudo apt install feroxbuster
```
{% endcode %}
***
* Scan
{% code overflow="wrap" lineNumbers="true" %}
```bash
feroxbuster -u $URL #Scan URL
feroxbuster -u $url -w $wordlist #Specify wordlist path
feroxbuster -u $url -t $threads #Specify number of concurrent threads
feroxbuster -u $url -L $threads #Limit number of concurrent scans
feroxbuster -u $url -t $threads #Specify file for output
feroxbuster -u $url -x $extension #Specify extension of files
feroxbuster -u $url -n #Don't scan recursively folders or endpoints
```
{% endcode %}
## Git-Dumper
* A tool to fetch the files and reconstruct a Git repository locally
*
### Commands
* Installation
{% code overflow="wrap" lineNumbers="true" %}
```bash
git clone https://github.com/arthaud/git-dumper
cd /git-dumper
pip install -r requirements.txt
python git_dumper.py http://$target/.git/ ./repo
```
{% endcode %}
## GitSniff
* A tool to fuzz *GitHub* repositories in search of hidden, deleted, or private forks
*
### Commands
* Installation
{% code overflow="wrap" lineNumbers="true" %}
```bash
git clone https://github.com/NotReallyJustin/GitSniff
cd /GitSniff
pip install requests
pip install tqdm
```
{% endcode %}
***
* Usage
{% code overflow="wrap" lineNumbers="true" %}
```bash
python ./gitsniff.py -u $repositoryURL
```
{% endcode %}
## Security Headers
* A web service that analyzes the HTTP response headers of any website and gives it a grade based on its security posture
*
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://kryptocoder.gitbook.io/hacking-knowledge/web-exploitation/tools-and-utilities.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.