Urlbuster是一款功能强大的Web目录模糊测试工具，该工具可以帮助广大研究人员定位目标应用程序中现有和隐藏的文件以及目录。该工具的功能类似于dirb和gobuster，但Urlbuster还提供了大量变异选项。
功能介绍
- 代理支持
- Cookie支持
- 基本身份验证
- 摘要授权
- 重试（对于慢速服务器）
- 持久性和非持久性HTTP连接
- 请求方法：GET、POST、PUT、DELETE、PATCH、HEAD、OPTIONS
- 自定义HTTP头
- 修改POST，PUT和PATCHPayload
- 使用不同的请求方法进行变异
- 使用不同的HTTP头进行变异
- 使用不同的文件扩展名进行变异
- 使用斜杠进行变异
- 枚举GET参数值
工具安装
广大研究人员在配置好Python和pip环境之后，可以直接使用下列命令安装Urlbuster：
pip install urlbuster
工具使用
usage: urlbuster [options] -w <str>/-W <file> BASE_URL urlbuster -V, --help urlbuster -h, --version URL bruteforcer to locate existing and/or hidden files or directories. Similar to dirb or gobuster, but also allows to iterate over multiple HTTP request methods, multiple useragents and multiple host header values. positional arguments: BASE_URL The base URL to scan. required arguments: -w str, --word str Word to use. -W f, --wordlist f Path to wordlist to use. optional global arguments: -n, --new Use a new connection for every request. If not specified persistent http connection will be used for all requests. Note, using a new connection will decrease performance, but ensure to have a clean state on every request. A persistent connection on the other hand will use any additional cookie values it has received from a previous request. -f, --follow Follow redirects. -k, --insecure Do not verify TLS certificates. -v, --verbose Show also missed URLs. --code str [str ...] HTTP status code to treat as success. You can use a '.' (dot) as a wildcard. Default: 2.. 3.. 403 407 411 426 429 500 505 511 --payload p [p ...] POST, PUT and PATCH payloads for all requests. Note, multiple values are allowed for multiple payloads. Note, if duplicates are specified, the last one will overwrite. See --mpayload for mutations. Format: <key>=<val> [<key>=<val>] --header h [h ...] Custom http header string to add to all requests. Note, multiple values are allowed for multiple headers. Note, if duplicates are specified, the last one will overwrite. See --mheaders for mutations. Format: <key>:<val> [<key>:<val>] --cookie c [c ...] Cookie string to add to all requests. Format: <key>=<val> [<key>=<val>] --proxy str Use a proxy for all requests. Format: http://<host>:<port> Format: http://<user>:<pass>@<host>:<port> Format: https://<host>:<port> Format: https://<user>:<pass>@<host>:<port> Format: socks5://<host>:<port> Format: socks5://<user>:<pass>@<host>:<port> --auth-basic str Use basic authentication for all requests. Format: <user>:<pass> --auth-digest str Use digest authentication for all requests. Format: <user>:<pass> --timeout sec Connection timeout in seconds for each request. Default: 5.0 --retry num Connection retries per request. Default: 3 --delay sec Delay between requests to not flood the server. --output file Output file to write results to. optional mutating arguments: The following arguments will increase the total number of requests to be made by applying various mutations and testing each mutation on a separate request. --method m [m ...] List of HTTP methods to test each request against. Note, each supplied method will double the number of requests. Supported methods: GET POST PUT DELETE PATCH HEAD OPTIONS Default: GET --mpayload p [p ...] POST, PUT and PATCH payloads to mutate all requests.. Note, multiple values are allowed for multiple payloads. Format: <key>=<val> [<key>=<val>] --mheader h [h ...] Custom http header string to add to mutate all requests. Note, multiple values are allowed for multiple headers. Format: <key>:<val> [<key>:<val>] --ext ext [ext ...] List of file extensions to to add to words for testing. Note, each supplied extension will double the number of requests. Format: .zip [.pem] --slash str Append or omit a trailing slash to URLs to test. Note, a slash will be added after the extensions if they are specified as well. Note, using 'both' will double the number of requests. Options: both, yes, no Default: no misc arguments: -h, --help Show this help message and exit -V, --version Show version information examples urlbuster -W /path/to/words http://example.com/ urlbuster -W /path/to/words http://example.com:8000/ urlbuster -k -W /path/to/words https://example.com:10000/
变异样例
对于某些网站来说，在使用某些特殊用户代理的情况下，即使调用的是相同的路径，Web应用程序的反应和行为也会不同。
$ urlbuster \ -W /usr/share/dirb/wordlists/common.txt \ --mheader 'User-Agent:Googlebot/2.1 (+http://www.googlebot.com/bot.html)' \ --method 'POST,GET,DELETE,PUT,PATCH' \ http://www.domain.tld/
工具使用样例
默认使用方式
基本：
$ urlbuster \ -W /path/to/wordlist.txt \ http://www.domain.tld/
Burpsuite代理：
$ urlbuster \ -W /path/to/wordlist.txt \ --proxy 'http://localhost:8080' \ http://www.domain.tld/
将结果存储至文件：
$ urlbuster \ -W /path/to/wordlist.txt \ --output out.txt \ http://www.domain.tld/
基础认证扫描：
$ urlbuster \ -W /path/to/wordlist.txt \ --auth-basic 'user:pass' \ http://www.domain.tld/
使用会话Cookie：
$ urlbuster \ -W /path/to/wordlist.txt \ --cookie 'PHPSESSID=a79b00e7-035a-2bb4-352a-439d855feabf' \ http://www.domain.tld/
查找文件
查找站点根目录中的文件：
$ urlbuster \ -W /path/to/wordlist.txt \ --code 200 301 302 \ --ext .zip .tar .tar.gz .gz .rar \ http://www.domain.tld/
查找站点子目录中的文件：
$ urlbuster \ -W /path/to/wordlist.txt \ --code 200 301 302 \ --ext .zip .tar .tar.gz .gz .rar \ http://www.domain.tld/wp-content/
高级使用
爆破查询参数：
$ urlbuster \ -W /path/to/wordlist.txt \ --method GET \ --code 200 301 302 \ http://www.domain.tld/search?q=
爆破POST请求：
$ urlbuster \ -W /path/to/wordlist.txt \ --code 200 301 302 \ --method POST \ --payload \ 'user=somename' \ 'pass=somepass' \ 'mail=some@mail.tld' \ 'submit=yes' \ http://www.domain.tld/
爆破变异POST请求：
$ urlbuster \ -w index.php \ --code 200 301 302 \ --method POST \ --mpayload \ 'user=somename1' \ 'user=somename2' \ 'user=somename3' \ 'pass=somepass1' \ 'pass=somepass2' \ 'pass=somepass3' \ 'mail=some@mail1.tld' \ 'mail=some@mail2.tld' \ 'mail=some@mail3.tld' \ 'submit=yes' \ http://www.domain.tld/wp-admin/
用户代理SQL注入：
$ urlbuster \ -W /path/to/wordlist.txt \ --code 5.. \ --method GET POST \ --mheader \ "User-Agent: ;" \ "User-Agent: ' or \"" \ "User-Agent: -- or #" \ "User-Agent: ' OR '1" \ "User-Agent: ' OR 1 -- -" \ "User-Agent: \" OR 1 = 1 -- -" \ "User-Agent: '='" \ "User-Agent: 'LIKE'" \ "User-Agent: '=0--+" \ "User-Agent: OR 1=1" \ "User-Agent: ' OR 'x'='x" \ "User-Agent: ' AND id IS NULL; --" \ http://www.domain.tld/
查找潜在的vhost：
$ urlbuster \ -w / \ --method GET POST \ --mheader \ "Host: internal1.lan" \ "Host: internal2.lan" \ "Host: internal3.lan" \ "Host: internal4.lan" \ "Host: internal5.lan" \ "Host: internal6.lan" \ http://10.0.0.1
许可证协议
本项目的开发与发布遵循MIT开源许可证协议。
项目地址
Urlbuster：【GitHub传送门】