Directory and access-control bypass tester — probes how a web server responds to path-manipulation variants of a protected route, to surface broken access control.
Unlike a plain directory brute-forcer, DirBusterPro takes each entry in a wordlist and generates path variations (trailing slash, encoding, traversal, case and separator tricks), then compares every response against a baseline (status code, length and content hash) to flag routes that behave differently — a common sign of an access-control bypass.
- Path-variation engine — generates multiple encodings and manipulations per payload
- Baseline diffing — compares status, response size and content hash to cut false positives
- Multi-threaded — up to configurable concurrent workers
- Session-aware — HTTP auth and persistent connections
- Proxy support — HTTP / HTTPS / SOCKS, with optional TLS verification off for lab targets
- Reports — CSV, JSON and HTML output
git clone https://github.com/CHDevSec/DirBusterPro.git
cd DirBusterPro
pip install requestspython3 DirBusterPro.py <url> <wordlist> [options]| Option | Description |
|---|---|
url |
Target URL, e.g. http://target/admin |
wordlist |
File with payloads to test (one per line) |
-t, --threads N |
Concurrent threads |
-o, --output FILE |
Output file (.csv, .json or .html) |
--timeout SECONDS |
Per-request timeout |
--ignore-ssl |
Skip TLS verification (lab targets) |
--proxy URL |
Route traffic through a proxy |
--auth user:pass |
HTTP basic auth |
-v, --verbose |
Verbose output |
python3 DirBusterPro.py http://target.local/admin wordlists/bypass.txt \
-t 40 --output report.html -vThis tool is intended for authorized security testing and education only. Use it exclusively against systems you own or have explicit written permission to assess. The author assumes no liability for misuse or for any damage caused by this software. You are responsible for complying with all applicable laws.
MIT © 2025-2026 Caio Henrique (CHDevSec)
Part of the CHDevSec security tooling — portfolio · LinkedIn