A lightweight directory enumeration tool written in pure Bash. Built for CTF players, penetration testers, and anyone who needs a simple, hackable directory brute-forcer that just works.
To get the idea about what is happening in the script, here is full explaination InfoSecPath .
I got tired of installing heavy tools on every fresh box during CTFs. Sometimes you're on a minimalist VM, sometimes you're SSH'd into a restricted environment, and sometimes you just want something you can read, understand, and tweak in 5 minutes.
Duster runs anywhere Bash and curl exist. No Python. No Go binaries. Just a script you can audit in one sitting.
Throws a wordlist at a web server and tells you what sticks. It'll find your /admin panels, /backup directories, and those .bak files someone forgot about.
The tool handles threading properly, follows directory redirects intelligently (no more spam about trailing slashes), and gives you clean output without drowning you in noise.
git clone https://github.com/ShieldedDev/Duster.git
cd Duster
chmod +x duster.shMake sure you have curl installed. You probably already do.
# Debian/Ubuntu
sudo apt install curl
# Arch
sudo pacusr -S curl
# Fedora/RHEL
sudo dnf install curlPoint it at a target:
./duster.sh -u https://target.comThat's it. It'll use a default wordlist and start hunting.
Want more control?
# Custom wordlist
./duster.sh -u https://target.com -w /path/to/wordlist.txt
# Crank up the speed
./duster.sh -u https://target.com -t 50
# Check for common file extensions
./duster.sh -u https://target.com -x
# Only show successful hits (clean output)
./duster.sh -u https://target.com -s
# Custom extensions for specific targets
./duster.sh -u https://target.com -e php,asp,jsp,bak-u <URL> Target URL (required)
-w <WORDLIST> Path to wordlist file
-t <THREADS> Number of concurrent threads (default: 20)
-T <TIMEOUT> Request timeout in seconds (default: 10)
-e <EXTS> Check specific extensions (comma-separated)
-x Enable extension checking with defaults
-f Follow redirects
-a <AGENT> Custom User-Agent string
-s Show only 200 responses (less noise)
-v Verbose mode (show everything)
-h Help menu
[200 FOUND] http://target.com/admin/ [DIR] (2048 bytes)
[200 FOUND] http://target.com/config.php (156 bytes)
[403 FORBIDDEN] http://target.com/private/ [DIR]
[200 FOUND] http://target.com/backup.zip (8192 bytes)
The tool automatically figures out when a redirect is just a directory trailing slash thing and follows it for you. No more seeing fifty 301 redirects that all just add a / at the end.
Results get saved to output/target-name/scan_timestamp.txt with a summary at the end.
Quick CTF scan:
./duster.sh -u http://10.10.11.123 -x -sBug bounty recon with custom wordlist:
./duster.sh -u https://target.com -w ~/wordlists/raft-large.txt -t 30 -xHunting for specific files:
./duster.sh -u https://target.com -e php,bak,old,zip,sqlBeing stealthy:
./duster.sh -u https://target.com -t 10 -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"CTFs - Fast, portable, easy to tweak during a competition
Pentesting restricted boxes - When you can't install tooling but have Bash and curl
Learning - The code is straightforward. Good for understanding how directory brute-forcing works under the hood
Quick recon - Sometimes you just need to check if /admin exists before moving on
Pretty simple worker model:
- Read wordlist line by line
- Spawn background workers that probe each path
- Limit concurrent workers based on thread count
- Parse HTTP response codes from curl
- Filter out noise (like automatic directory trailing slash redirects)
- Log interesting findings
The threading is handled with Bash background jobs and a simple counter. Not fancy, but it works well enough.
The tool sends HEAD requests by default (faster, less invasive). It tracks response codes, sizes, and redirect locations. When it sees a 301 redirect that's just adding a trailing slash, it automatically follows it and shows you the actual result instead of cluttering your output.
Extension checking works by testing each directory path with and without your specified extensions. Useful for finding config.php, backup.zip, database.sql, etc.
All output goes to timestamped files organized by target, so you can run multiple scans without losing history.
This is a Bash script that shells out to curl repeatedly. It's not going to match the speed of compiled scanners like gobuster or ffuf on massive wordlists. But for most CTF and lab scenarios, it's fast enough and way more convenient.
No fancy features like recursive scanning, authentication, or custom headers beyond User-Agent. Keep it simple.
Found a bug? Have an idea? Open an issue or send a PR. The code is meant to be readable and hackable.
MIT. Do whatever you want with it.
Built with inspiration from DirBuster, gobuster, and all those late-night CTF sessions where I wished I had a simple scanner I could just modify on the fly.
Made for hackers, by hackers. Happy hunting.