How to Directory Brute Force Properly

[@crusader_]

The titles are getting better Ben. Makes you wanna click the video. And the best part is you're not clickbaited.

[@NahamSec]

Thanks. I’m trying to walk a fine line with what I put on titles and thumbnails!

[@AshleyEhSMR]

I agree, because it’s very rare I will watch a video under 20 mins and clicked when I saw it. 🎉

[@TCMSecurityAcademy]

FFUF is OP and so are you.

[@NahamSec]

💪🏼💪🏼 thanks homie!

[@sveneFX]

Hey Ben, thanks for sharing your knowledge! I would love to see approaches for custom wordlists, keep up the good work 👍

[@NahamSec]

I'll see what I can come up with :)

[@juliusrowe9374]

Ben, super dope content! Can you do a video on how to create and maintain a decent word list and the tricks ( Do's and Don'ts) and your recommendations?

[@NahamSec]

I got you! Give me a few weeks.

[@crusader_]

Loving this series

[@rajasekharreddy7977]

Thanks man. Great video.
Looking forward for the video for making custom wordlists.

[@CodeAcademia00]

Keep going brother , that's amazing 🙏

[@aow6813]

Thanks ! We love you man keep up the good work

[@thuglife896]

Good presentation, and explains details that other hacking channels don't 👍

[@jokejunction415]

Great content bro cant thank enough

[@rahmat_qurishi]

Great as usual♥️

[@abhinavkumar8052]

exactly what I want. Thanks
And yes make a video on how to make a custom wordlist

[@NahamSec]

I got you! Give me a few weeks.

[@sourabhekka]

@@NahamSec Request you to make video on " How to create/make custom wordlist based on the target?"

[@MFoster392]

Another great video

[@stón_1]

feroxbuster is my favorite 🙂

[@websuraksha1600]

your content is excellent. you really do work hard for us. hey ben please make a video on how to create own wordlist.

[@Budokid]

I noticed in your ffuf command you don’t looked for a status of 500. Is that something you ever look for situationally? Sometimes I find that if you hit a route that is expecting certain parameters but they are missing from the request some applications will give you 500 errors

[@shashankmudgal4581]

Please make a dedicated video on how to make your own target specefic wordlist.

[@saminbinhumayun858]

If there is scope given in bb program do we need to do directory bruteforcing?

[@Hari-888]

Also, you mentioned that I should do dir bruteforcing in the cloud. how exactly would I do that ? edit... Never mind, I saw on another video of yours that you mentioned running things on digitalocean.

[@Hari-888]

thank you, this was super helpful

[@mohamedalfadile6838]

it's highly important way many thanks 😍😍

[@nafizimtiaz9367]

thanks Ben. it was awesome and fun to learn things which i did in wrong. actually i came from CFT''s to web security penetration testing. A question! How long do you think i should spend on a program . and i am quite beginner in security.

[@jaywandery9269]

iam at the same exact level. Iam curious to understand how this is taking you so far

[@eligoldiner]

great, thanks! how would you approach a targets list of several subdomains?

[@laurent9255]

I found an open redirect this way . There was an endpoint like "app-login" i tried to fuzz the part after the dash "login" and found "logout". Then i fuzzed for hidden parameters on this endpoint and found "redirect" wich was vulnerable to open redirect.

[@hackersguild8445]

did you try for xss on that redirect parameter?

[@laurent9255]

@@hackersguild8445 Yes but i failed :(

[@HackerJi01]

It's awesome sir ...🔥🔥

[@eldanicarvajal]

What do you think about feroxbuster?

[@vladiaveryanov610]

What is your approach if after 10 attempts you get banned by IP? Or what do you do if you generate so much traffic on the target and you need to slow down the requests per second?

[@Pwnedby]

You can lower the threads and use a proxy list

[@brainless_bin9414]

Wfuzz and ffuf i do prefer 🔥

[@NahamSec]

Love ffuf!

[@rezafadaei8388]

Thank you so much!
Can you please also make a video of how to make custom world list based of the webapplication?
What regex's are your favourite in that matter?

[@firosiam7786]

Could u do a series on web hacking or smthg like that

[@leghdaf]

Thanks Man ...

[@umarfarooq9950]

FFUF because easy to use and automate and fast !

[@milestips]

Thanks You!!!

[@hashmatrixuniverse5203]

You have youtube channel

[@mtech1935]

Thanks ben for the great content♥️ but the video quality is so low I have set 1080p but thw quality is very poor in case of showing any text in the video those texts are a bit blurry

[@NahamSec]

I’m not experiencing that. Everything is shot in 1080 or higher.

[@dibens]

​@@NahamSec The part where you show SecLists github is in low resolution. Everything else looks good.

[@mtech1935]

@nahamsec the other part is really fine but when you show some texts like you were mentioning about the seclist part it was not in good quality

[@swoodby09]

@NahamSec are you doing your recon from the cloud / vps or local?

[@NahamSec]

VPS using digital ocean. Check out the video description for some free goodies :)

[@tyrondacreator]

Is it okay to do directory brute forcing to find assets?

[@NahamSec]

Yes, but make sure you aren't sending too many requests and contextualizing your brute force.

[@antnio773]

dirsearch combined with ffuf (for files as it is more easily manageable)

[@singing_dev]

I use gobuster and dirbuster

[@cadetpriyanshu6987]

I like dirsearch ❤

[@obfuscated65535]

I like gobuster and dirsearch

[@NahamSec]

Dirsearch is ❤️

[@ashleypursell9702]

ooft the one-app thing is a good tip thanks for this

[@abdullahbhatti9730]

How to Brute Force in the Cloud?

[@Hari-888]

He means using a vps like digitalocean I believe

[@fa7han748]

17590 req/sec how????? :") my vps dont go to even 1000 req

[@chiragartani]

Thank you! Could you please create a video about How to write a bash script for fuzzing directory on all the subdomains we got with ffuf?

[@NahamSec]

hmm. Maybe!

[@Aolpha]

I got one working one

[@chiragartani]

@@Aolpha could you share please

[@techhacker7711]

Op bro

[@cguzmanvisuals]

Personally, I prefer FFUF

[@techofch]

with using FFUF :)

[@M0M3NTUM33]

Axiom... do yourself a favor... look it up

[@Jason.1734]

It dosnt work these days servers just permanently block you

[@DevCucr]

Next game pasword cracking

[@neon_Nomad]

This is way too prescient

[@msalih]

I just realized that we can use ffuf instead dirsearch. For Example
domains.txt
wordlist.txt
extensions.txt
ffuf -w domains.txt:D -w wordlist.txt:F -w extensions.txt:E -u D/F.E

[@tsrisanath8441]

There is a extension flag in ffuf . It would be with -e or -x check it out with ffuf -h command

[@msalih]

@@tsrisanath8441 I didnt know thanks 😊👍

[@brainless_bin9414]

I'm struggling find .esp files which is pan os directory i don't know where to get it because i tried everything 🥲