Create a Custom Hacking Directory Buster

Summary

In this tutorial, the creator walks viewers through building a simple Python directory buster tool to fuzz websites and find hidden directories. The script, consisting of around 35 lines of code, uses requests, argparse, and system libraries to iterate through a wordlist and check for existing directories on a target website. The video emphasizes debugging common typos, provides tips on using IDEs like PyCharm, and includes troubleshooting advice. The goal is to teach beginners the basics of Python programming while building a useful tool for web security testing.

Takeaways

• 😀 The video demonstrates how to create a Python-based directory buster tool for fuzzing websites and finding directories.
• 😀 The project is simple, consisting of about 35 lines of code, two main functions, and a few variables.
• 😀 It's a good project for beginners to start learning Python and web security-related tasks.
• 😀 The speaker emphasizes debugging and encourages viewers to type out the code themselves to learn better.
• 😀 The video suggests using PyCharm for better error detection, though the speaker uses VS Code in the demonstration.
• 😀 The tool will involve importing necessary libraries like requests, argparse, and urlparse to handle URLs and arguments.
• 😀 The speaker walks through the process of setting up a parser to handle the base URL and wordlist from command-line arguments.
• 😀 A key function (`en`) is created to ensure URLs have the correct HTTP/HTTPS schema and trailing slash.
• 😀 Another function (`brute`) is designed to loop through the wordlist and test for directories using HTTP requests.
• 😀 The tool makes HTTP requests with a timeout of 1 second to check if a directory exists, reporting back with success or failure messages.
• 😀 The speaker acknowledges common errors like typos and offers debugging help, emphasizing the importance of solving issues independently for learning.

Q & A

What is the main objective of the Python script being built in the video?

The main objective is to build a directory buster that can fuzz websites and search for different directories.

How long is the Python script and what components does it contain?

The script is about 35 lines of code, consisting of only two functions and a few variables.

Why is PyCharm recommended for this Python project?

PyCharm is recommended because it has a built-in text editor that helps catch typos, making debugging easier compared to other editors like VS Code.

What modules are imported in the script and why?

The script imports the 'requests' module for HTTP requests, 'argparse' for argument parsing, 'os' from the system for file handling, and 'urlparse' for URL manipulation.

What does the 'base URL' variable do in the script?

The 'base URL' is the starting point of the website that the directory buster will attempt to fuzz, adding different words from the wordlist to discover hidden directories.

What is the purpose of the wordlist in the script?

The wordlist is used to test various directory names by appending each word from the list to the base URL in an attempt to discover directories on the website.

How does the script ensure that the base URL is properly formatted?

The script checks if the base URL starts with 'http' or 'https' and adds 'https' if missing. It also ensures a trailing slash is present at the end of the URL.

What happens if the directory buster finds a valid directory?

If a valid directory is found (HTTP status code 200), the script prints a message indicating the directory URL was found.

What does the script do if it encounters a timeout or connection error?

The script handles timeouts and connection errors by printing appropriate error messages indicating the URL that caused the issue.

What did the author fix after encountering typos in the code?

The author fixed several typos, such as incorrect function names and variable names, and corrected issues related to the wordlist and base URL handling.