Enum path && dir on target URL. Powered by Rust ! 🦀

Overview

enum-dir

一款快速枚举目录的小工具,使用 Rust 编写,扫起来真的很快。

用于发现目标站点中可能存在的路径信息,同时支持字典模式和暴力枚举模式。

本工具仅用于学习 Rust 以及 Rust 协程 Tokio 使用,严禁用于非法用途。

如果使用本工具从事违法犯罪活动,造成的任何后果,本人不承担任何责任。

1. 开始使用

1.1 方法1:手动编译

git clone https://github.com/lightless233/enum-dir.git
cd enum-dir
cargo build --release 
./target/release/enum-dir

1.2 方法2:直接下载构建好的二进制文件

访问 https://github.com/lightless233/enum-dir/tags 页面,寻找最新的 Tag 并下载对应的文件。

2. 参数说明

USAGE:
    enum-dir [OPTIONS] --target <target>

OPTIONS:
    -t, --target <target>              待爆破文件的链接,例如 https://example.com/
    -d, --dict <dict>                  字典模式,指定此模式后,将禁用枚举模式,如果为空,则使用内置字典
    -l, --length <length>              爆破文件名的最大长度,默认为3 [default: 3]
        --fixed-length                 固定枚举长度,而非枚举 1..=length
    -m, --method <method>              枚举时使用的 HTTP 方法,默认为 HEAD [default: HEAD]
    -n, --task-count <task-count>      最大并发数量,默认为25 [default: 25]
    -s, --suffix <suffix>              待枚举的文件后缀,多个后缀使用英文逗号分割,默认为:html,htm,php,zip,tar.gz,tar.bz2
                                       [default: html,htm,php,zip,tar.gz,tar.bz2]
    -e, --empty-suffix                 是否枚举空后缀,默认枚举
    -o, --output <output>              输出文件路径 [default: ./enum-dir-result.txt]
    -c, --cookie <cookie>              指定枚举时使用的cookie
    -H, --header <header>              指定枚举时的 http header
        --user-agent <user-agent>      指定扫描时候的UA,默认使用 enum-dir 内置的UA [default:
                                       EnumDir/0.0.1]
        --random-user-agent            使用随机的 user-agent,来源于 sqlmap,thanks sqlmap
        --http-retry <http-retry>      当某次请求失败是,重试次数,默认为2 [default: 2]
    -p, --proxy <proxy>                socks5 代理或 http 代理,例如 socks5://127.0.0.1:1080
        --black-words <black-words>    黑名单关键字,默认为空,设置后当页面内容出现指定的关键字时,认为页面不存在,不记录到结果中。开启该功能后,自动切换为
                                       GET 方法。
    -h, --help                         Print help information
    -V, --version                      Print version information

2.1 字典模式说明

字典为纯文本文件,每行一个,支持以下特殊格式:

# 井号开头的行为注释行,扫描时将会自动忽略,同时也会忽略空行

# 以下为普通的字典内容
admin/index.php
/admin/index.php.bak

# 如果字典中出现 %EXT% ,则会使用指定的 suffix 依次替换
# 例如:index%EXT%,使用默认 suffix 时,
# 在扫描时会生成如下的列表:
# index.html, index.htm, index.php, index.zip, index.tar.gz, index.tar.bz2
index%EXT%

# 除了 %EXT% 外,还支持以下占位符
# %ALPHA%:使用 a-zA-Z 的字符占位
# %NUMBER%:使用 0-9 的字符占位
# %ALPHANUM%:使用 0-9a-zA-Z 的字符占位
# 例如 foo/%ALPHANUM%%EXT% 将会依次生成:
# foo/0.html
# foo/0.htm
# foo/0.php
# ...
# foo/Z.tar.gz
# foo/Z.tar.bz2

2.2 使用样例

# 使用内置字典对目标进行枚举,允许空后缀(内置的字典为 ./dicts/default.txt,如果想使用其他字典,需要手动指定)
$ ./enum-dir -t https://example.com/ -e -d 

# 使用指定字典对目标进行枚举,允许空后缀
$ ./enum-dir -t https://example.com/ -e -d ./dicts/top.txt

# 爆破模式,爆破长度为1-5,允许空后缀,使用50个协程并发
$ ./enum-dir -t https://example.com/ -e -l 5 -n 50

# 爆破模式,指定 HTTP Method 为 GET,并且使用指定的 HTTP 头
$ ./enum-dir -t https://example.com/ -m GET -H "Content-Type: application/json" -H "X-Auth: 11223344"

# 字典模式,内置字典,随机UA,指定输出文件
$ ./enum-dir -t https://example.com/ --random-user-agent -d -o ./output.txt

3. 支持计划

  • 使用字典枚举
  • 支持 socks5 代理
  • 支持网络错误重试机制
  • 支持自定义 headers、cookies
  • 字典模式中,支持通过占位符动态生成枚举串
  • github action 自动构建二进制文件
  • 性能优化
You might also like...
A Rust application which funnels external webhook event data to an Urbit chat.
A Rust application which funnels external webhook event data to an Urbit chat.

Urbit Webhook Funnel This is a simple Rust application which funnels external webhook event data to an Urbit chat. This application is intended to be

A html document syntax and operation library written in Rust, use APIs similar to jQuery.

Visdom A server-side html document syntax and operation library written in Rust, it uses apis similar to jQuery, left off the parts thoes only worked

Actix Web is a powerful, pragmatic, and extremely fast web framework for Rust.

Actix Web is a powerful, pragmatic, and extremely fast web framework for Rust.

Starlight is a JS engine in Rust which focuses on performance rather than ensuring 100% safety of JS runtime.

starlight Starlight is a JS engine in Rust which focuses on performance rather than ensuring 100% safety of JS runtime. Features Bytecode interpreter

A rust web framework with safety and speed in mind.

darpi A web api framework with speed and safety in mind. One of the big goals is to catch all errors at compile time, if possible. The framework uses

A web framework for Rust.

Rocket Rocket is an async web framework for Rust with a focus on usability, security, extensibility, and speed. #[macro_use] extern crate rocket; #[g

Rust / Wasm framework for building client web apps
Rust / Wasm framework for building client web apps

Yew Rust / Wasm client web app framework Documentation (stable) | Documentation (latest) | Examples | Changelog | Roadmap | 简体中文文档 | 繁體中文文檔 | ドキュメント A

问卷反馈收集, 前端脚手架安装向导, rust, gtk3, win32, dll
问卷反馈收集, 前端脚手架安装向导, rust, gtk3, win32, dll

scaffold-wizard 这是一款加持了【图形用户界面】的npm - inquirer(名曰:问卷)。即,根据【问卷】配置文件,以人-机交互的形式,收集终端用户的【回答结果】。这里提到的【问卷配置】与【回答结果】都是*.json格式的字符串(或文件)。 【问卷】既能够作为.exe文件被双击运行

Moodle CMS Notifications in Rust
Moodle CMS Notifications in Rust

Moodle CMS Notifications View unread Moodle CMS notifications. Mark all notifications as read. Lightweight with no dependencies. Cross platform. Authe

Releases(v0.1.4)
Owner
lightless
Alibaba Security. Vidar-Team.
lightless
A Rust crate for managing authentication and authorization with support for multi-tenant / B2B products, powered by PropelAuth

PropelAuth Add authentication and authorization to your application. This library is meant to be used with a PropelAuth account. You can sign up and g

PropelAuth 3 Dec 10, 2022
Rust Macro which loads files into the rust binary at compile time during release and loads the file from the fs during dev.

Rust Embed Rust Custom Derive Macro which loads files into the rust binary at compile time during release and loads the file from the fs during dev. Y

Peter 1k Jan 5, 2023
Rust I18n is use Rust codegen for load YAML file storage translations on compile time, and give you a t! macro for simply get translation texts.

Rust I18n Rust I18n is use Rust codegen for load YAML file storage translations on compile time, and give you a t! macro for simply get translation te

Longbridge 73 Dec 27, 2022
lispr is a Rust macro that tries to implement a small subset of LISPs syntax in Rust

lispr lispr is a Rust macro that tries to implement a small subset of LISPs syntax in Rust. It is neither especially beautiful or efficient since it i

Jan Vaorin 0 Feb 4, 2022
Rust/Axum server implementation with PCR(Prisma Client Rust)

Realworld Rust Axum Prisma This project utilizes Rust with the Axum v0.7 framework along with the Prisma Client Rust to build a realworld application.

Neo 3 Dec 9, 2023
A Rust web framework

cargonauts - a Rust web framework Documentation cargonauts is a Rust web framework intended for building maintainable, well-factored web apps. This pr

null 179 Dec 25, 2022
A Rust library to extract useful data from HTML documents, suitable for web scraping.

select.rs A library to extract useful data from HTML documents, suitable for web scraping. NOTE: The following example only works in the upcoming rele

Utkarsh Kukreti 829 Dec 28, 2022
openapi schema serialization for rust

open api Rust crate for serializing and deserializing open api documents Documentation install add the following to your Cargo.toml file [dependencies

Doug Tangren 107 Dec 6, 2022
📮 An elegant Telegram bots framework for Rust

teloxide A full-featured framework that empowers you to easily build Telegram bots using the async/.await syntax in Rust. It handles all the difficult

teloxide 1.6k Jan 3, 2023
Sōzu HTTP reverse proxy, configurable at runtime, fast and safe, built in Rust. It is awesome! Ping us on gitter to know more

Sōzu · Sōzu is a lightweight, fast, always-up reverse proxy server. Why use Sōzu? Hot configurable: Sozu can receive configuration changes at runtime

sōzu 2k Dec 30, 2022