En Kapsamlı Gobuster/Dirsearch Cheatsheet (All Commands)

BÖLÜM 1: GOBUSTER​

TEMEL KULLANIM​

Basit directory brute-force (dir modu)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt

Dosya uzantıları ile tarama (php, html, txt, zip, bak)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -x php,html,txt,zip,bak,old,log,conf

Thread sayısını ayarla (varsayılan 10, performans için 50-100)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -t 50

Sonuçları dosyaya kaydet​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -o results.txt

Expanded mode (tam URL'leri göster)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -e

Content length göster (sayfa boyutuna göre filtreleme için)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -l

JSON formatında çıktı (güncel sürümlerde)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -o results.json --json

Content length filtrele (belirli boyuttaki sayfaları gizle)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --length -1

---

DNS SUBDOMAIN KEŞFİ (dns MODU)​

DNS subdomain brute-force​

gobuster dns -d example.com -w /path/to/subdomains.txt

Thread ile hızlandır​

gobuster dns -d example.com -w /path/to/subdomains.txt -t 100

IP adreslerini de göster​

gobuster dns -d example.com -w /path/to/subdomains.txt -i

CNAME kayıtlarını göster​

gobuster dns -d example.com -w /path/to/subdomains.txt -c

Özel DNS resolver kullan (Google DNS, Cloudflare vb.)​

gobuster dns -d example.com -w /path/to/subdomains.txt -r 8.8.8.8

Wildcard DNS tespiti ve bypass​

gobuster dns -d example.com -w /path/to/subdomains.txt --wildcard

Sonuçları dosyaya yaz​

gobuster dns -d example.com -w /path/to/subdomains.txt -o subdomains.txt

---

VIRTUAL HOST KEŞFİ (vhost MODU)​

Virtual host brute-force (aynı IP'deki farklı siteler)​

gobuster vhost -u https://example.com -w /path/to/vhosts.txt

TLS sertifika doğrulamasını atla​

gobuster vhost -u https://example.com -w /path/to/vhosts.txt -k

Status code filtrele (sadece 200, 301, 302 göster)​

gobuster vhost -u https://example.com -w /path/to/vhosts.txt -s 200,301,302

---

FUZZING MODU (PARAMETRE VE ENDPOINT)​

URL içinde FUZZ keyword ile fuzzing​

gobuster fuzz -u https://example.com/FUZZ/admin -w /path/to/wordlist.txt

Parametre fuzzing (FUZZ ile)​

gobuster fuzz -u "https://example.com/api?user=FUZZ&id=1" -w /path/to/usernames.txt

Header fuzzing (FUZZ ile)​

gobuster fuzz -u https://example.com -w /path/to/headers.txt -H "X-Forwarded-For: FUZZ"

Extension ile fuzzing​

gobuster fuzz -u https://example.com/file.FUZZ -w /path/to/extensions.txt

---

S3 / GCS / TFTP MODLARI​

S3 bucket keşfi​

gobuster s3 -w /path/to/bucket-names.txt

Google Cloud Storage bucket keşfi​

gobuster gcs -w /path/to/bucket-names.txt

TFTP dosya keşfi​

gobuster tftp -u tftp://example.com -w /path/to/files.txt

---

GELİŞMİŞ AYARLAR​

Status code filtrele (404 ve 403'ü gizle)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -b 404,403

Sadece belirli status code'ları göster​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -s 200,301,302

Cookie ile kimlik doğrulama​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -c "session=abc123; user=admin"

Özel Header ekleme​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -H "Authorization: Bearer token123" -H "X-Forwarded-For: 127.0.0.1"

User-Agent değiştir​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"

Client sertifikası ile kimlik doğrulama​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --client-cert client.pem --client-key key.pem

Redirect'leri takip et​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -r

Max redirect sayısı​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -r --max-redirects 5

Recursive tarama (bulunan dizinleri de tara)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --recursive

Recursive depth belirle (kaç katman derin)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --recursive --recursion-depth 3

Timeout ayarla (varsayılan 10s)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --timeout 30s

Delayer (rate limit atlatma)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --delay 500ms

Sessiz mod (banner ve gereksiz çıktıyı gizle)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -q

Verbose mod (detaylı hata mesajları)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -v

Fail on error (hata durumunda durdur)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --fail-on-error

Retry (başarısız istekleri tekrarla)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --retry

Retry attempts (kaç kere tekrar dene)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --retry --retry-attempts 3

No status codes (status code'ları gizle)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -n

---

WAF ATLATMA TEKNİKLERİ​

Header ile WAF bypass (X-Forwarded-For)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -H "X-Forwarded-For: 127.0.0.1"

Tor ile anonim tarama (proxychains)​

proxychains gobuster dir -u https://example.com -w /path/to/wordlist.txt -t 10

HTTP proxy ile (Burp Suite)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --proxy http://127.0.0.1:8080

SOCKS5 proxy ile (Tor)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --proxy socks5://127.0.0.1:9050

Proxy auth​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --proxy http://user:[email protected]:8080

Rastgele User-Agent kullan​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --random-agent

TLS kontrolünü kapat (self-signed sertifikalar için)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -k

Delayer ile yavaşlat (WAF'dan kaçın)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --delay 1000ms -t 5

IP rotasyonu (proxy listesi ile döngü) - DÜZELTİLMİŞ​

while read proxy; do
gobuster dir -u https://example.com -w /path/to/wordlist.txt --proxy "{proxy}.txt"
sleep 2
done < proxies.txt

Rastgele delay (randomize)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --delay 500ms-1500ms

---

PERFORMANS OPTİMİZASYONU​

Yüksek thread (hızlı tarama)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -t 200

Düşük thread + delay (sessiz tarama)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -t 5 --delay 500ms

Büyük wordlist için optimize​

gobuster dir -u https://example.com -w /path/to/big_wordlist.txt -t 100 -o results.txt

Sadece belirli uzantıları tara (hızlandır)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -x php,html

Status code filtreleme ile hızlandır​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -b 404,403,500

---

DİĞER ARAÇLARLA ENTEGRASYON​

Gobuster + httpx (canlı subdomain kontrolü)​

gobuster dns -d example.com -w /path/to/subdomains.txt -o subdomains.txt && httpx -l subdomains.txt -o alive.txt

Gobuster + nuclei (zafiyet taraması)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -o directories.txt && nuclei -l directories.txt -t cves/

Gobuster + ffuf (dizin fuzzing)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -o dirs.txt && ffuf -u https://example.com/FUZZ -w dirs.txt

Gobuster + nmap (port taraması ile kombine)​

nmap -p 80,443 -sV example.com && gobuster dir -u https://example.com -w /path/to/wordlist.txt

Gobuster + Burp Suite (proxy ile yakalama)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --proxy http://127.0.0.1:8080

---

ÖRNEK TAM ZİNCİR (GOBUSTER)​

1. DNS subdomain keşfi​

gobuster dns -d example.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -t 100 -i -o subdomains.txt

2. Canlı subdomain kontrolü​

httpx -l subdomains.txt -o alive.txt

3. Directory brute-force (her canlı subdomain için) - DÜZELTİLMİŞ​

cat alive.txt | while read url; do
safe_name=(echo"(echo"url" | sed 's|https?://||; s|/|_|g')
gobuster dir -u "url"−w/usr/share/seclists/Discovery/Web−Content/common.txt−xphp,html,txt,zip,bak−t50−o"url"−w/usr/share/seclists/Discovery/Web−Content/common.txt−xphp,html,txt,zip,bak−t50−o"{safe_name}_dirs.txt"
done

4. Virtual host keşfi (aynı IP'deki diğer siteler)​

gobuster vhost -u https://example.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -t 50 -o vhosts.txt

5. Fuzzing ile parametre keşfi​

gobuster fuzz -u "https://example.com/api?user=FUZZ&id=1" -w /usr/share/seclists/Discovery/Web-Content/api-words.txt

6. S3 bucket keşfi​

gobuster s3 -w /usr/share/seclists/Discovery/Web-Content/bucket-names.txt -o buckets.txt

7. Rapor oluştur​

cat subdomains.txt alive.txt vhosts.txt buckets.txt | sort -u > full_recon.txt

---

KRİTİK NOTLAR (GOBUSTER)​

• Gobuster Go ile yazılmıştır, çok hızlıdır ve kaynak tüketimi düşüktür.
• --wildcard ile wildcard DNS tespiti yapabilirsiniz.
• -e flag'i tam URL gösterir, otomasyon için idealdir.
• -l ile content length gösterir, sahte sayfaları elemek için kullanılır.
• --recursive ile bulunan dizinleri otomatik olarak tarar.
• --delay ile rate limit atlatabilirsiniz.
• -b ile istenmeyen status code'ları filtreleyebilirsiniz.
• -s ile sadece belirli status code'ları gösterebilirsiniz.
• --client-cert ile istemci sertifikası kullanabilirsiniz.
• --retry ile başarısız istekleri tekrarlayabilirsiniz.
• --json ile JSON formatında çıktı alabilirsiniz.
• Proxy kullanımı (Burp, Tor) ile trafiği izleyebilir ve WAF'dan kaçabilirsiniz.
• Wordlist olarak SecLists kullanmanız önerilir.
• Tüm bu işlemler YASAL ve ETİK kurallara uygun olmalıdır.

---

BÖLÜM 2: DIRSEARCH​

TEMEL KULLANIM​

Basit directory brute-force​

dirsearch -u https://example.com -w /path/to/wordlist.txt

URL ve extension belirleme​

dirsearch -u https://example.com -e php,html,txt,zip

Çoklu URL tarama (dosyadan)​

dirsearch -l urls.txt -e php,html

Sessiz mod (sadece sonuçlar)​

dirsearch -u https://example.com -q

Sonuçları dosyaya kaydet​

dirsearch -u https://example.com -o results.txt

JSON formatında çıktı​

dirsearch -u https://example.com -o results.json --format json

Simple output (sadece bulunanlar)​

dirsearch -u https://example.com --simple-output=results.txt

Markdown formatında çıktı​

dirsearch -u https://example.com -o results.md --format markdown

CSV formatında çıktı​

dirsearch -u https://example.com -o results.csv --format csv

---

GELİŞMİŞ PARAMETRELER​

Thread sayısını ayarla (varsayılan 25)​

dirsearch -u https://example.com -t 10

Request delay (rate limit atlatma)​

dirsearch -u https://example.com -t 5 --delay 0.5

Timeout ayarla​

dirsearch -u https://example.com --timeout 10

Recursive tarama (bulunan dizinleri de tara)​

dirsearch -u https://example.com -r

Recursive depth (kaç katman)​

dirsearch -u https://example.com -r -R 3

Sadece belirli status code'ları göster​

dirsearch -u https://example.com --filter-status=200,301,302

Belirli status code'ları gizle​

dirsearch -u https://example.com --exclude-status=404,403

Content length filtrele (sahte sayfaları elemek için)​

dirsearch -u https://example.com --filter-length=1234

Content length exclude​

dirsearch -u https://example.com --exclude-length=1234,5678

Size filtrele (bytes) - min ve max​

dirsearch -u https://example.com --min-response-size=1024
dirsearch -u https://example.com --max-response-size=102400

Regex filtrele​

dirsearch -u https://example.com --filter-regex="^404"

Redirect filtrele​

dirsearch -u https://example.com --filter-redirect="https://example.com/login"

Redirect history göster​

dirsearch -u https://example.com --redirect-history

Exclude text (yanıt içinde belirli metin varsa gizle)​

dirsearch -u https://example.com --exclude-text="Not Found"

Include text (yanıt içinde belirli metin varsa göster)​

dirsearch -u https://example.com --include-text="Welcome"

Full URL göster​

dirsearch -u https://example.com --full-url

Auto-pause (rate-limit aşımını önlemek için) - bazı fork'larda​

dirsearch -u https://example.com --auto-pause=100

---

WORDLIST VE EXTENSION YÖNETİMİ​

Multiple wordlist kullan​

dirsearch -u https://example.com -w wordlist1.txt,wordlist2.txt

Force extensions (her kelimeye extension ekle)​

dirsearch -u https://example.com -e php,html -f

Overwrite extensions (mevcut extension'ları değiştir)​

dirsearch -u https://example.com -e jsp,jspa -O

%EXT% keyword ile özel extension kullanımı​

Wordlist'te: admin.%EXT% -> admin.php, admin.html​

Wordlist'ten stdin ile oku​

cat wordlist.txt | dirsearch -u https://example.com --stdin

Prefix/Suffix ekleme​

dirsearch -u https://example.com --prefix=admin_ --suffix=.php

---

HTTP METOT VE BAŞLIK YÖNETİMİ​

HTTP metodu belirle (GET, POST, HEAD, OPTIONS, PUT, DELETE)​

dirsearch -u https://example.com -X POST

Özel Header ekleme​

dirsearch -u https://example.com -H "Authorization: Bearer token123" -H "X-Forwarded-For: 127.0.0.1"

User-Agent değiştir​

dirsearch -u https://example.com -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"

Cookie ile kimlik doğrulama​

dirsearch -u https://example.com --cookie="session=abc123; user=admin"

Referer sahtekarlığı​

dirsearch -u https://example.com --referer="https://google.com"

---

PROXY VE AĞ AYARLARI​

HTTP proxy kullan (Burp Suite)​

dirsearch -u https://example.com --proxy http://127.0.0.1:8080

SOCKS5 proxy (Tor)​

dirsearch -u https://example.com --proxy socks5://127.0.0.1:9050

Proxy auth​

dirsearch -u https://example.com --proxy http://user:[email protected]:8080

Tor ile anonim​

dirsearch -u https://example.com --proxy socks5://127.0.0.1:9050 -t 10

SSL doğrulamasını kapat​

dirsearch -u https://example.com -k

Client sertifikası​

dirsearch -u https://example.com --cert-file=client.pem --cert-key=key.pem

---

GELİŞMİŞ FİLTRELEME VE ATLATMA​

Matcher mode (OR / AND)​

dirsearch -u https://example.com --matcher-mode=or

WAF atlatma için header ekleme​

dirsearch -u https://example.com -H "X-Forwarded-For: 127.0.0.1" -H "X-Real-IP: 127.0.0.1"

User-Agent rotasyonu için script​

for ua in "Mozilla/5.0" "Chrome/91" "Firefox/89"; do
dirsearch -u https://example.com -a "{ua}.txt"
done

Delayer ile WAF'dan kaçın​

dirsearch -u https://example.com -t 5 --delay 1

Random delay​

dirsearch -u https://example.com --delay 0.5-1.5

IP ban riskini azaltmak için proxy listesi​

DÜZELTİLMİŞ: proxies.txt içindeki her proxy için döngü​

while read proxy; do
dirsearch -u https://example.com --proxy "{proxy}.txt"
sleep 2
done < proxies.txt

WAF tespiti (403/406 yanıtları WAF göstergesi)​

dirsearch -u https://example.com -t 5 --delay 1 -v | grep -E "403|406"

---

SESSION VE RAPORLAMA​

Session kaydet (devam ettirmek için)​

dirsearch -u https://example.com -s session.txt

Session'dan devam et​

dirsearch -u https://example.com --session=session.txt

Config dosyası kullan​

dirsearch -u https://example.com --config=/path/to/config.ini

Plain text rapor​

dirsearch -u https://example.com -o report.txt

JSON rapor​

dirsearch -u https://example.com -o report.json --format json

Markdown rapor​

dirsearch -u https://example.com -o report.md --format markdown

CSV rapor​

dirsearch -u https://example.com -o report.csv --format csv

Zaman damgalı log​

dirsearch -u https://example.com -o "scan_$(date +%Y%m%d_%H%M%S).txt"

---

DİĞER ARAÇLARLA ENTEGRASYON​

Dirsearch + httpx​

dirsearch -u https://example.com -e php,html -o dirs.txt && httpx -l dirs.txt -o alive_dirs.txt

Dirsearch + nuclei​

dirsearch -u https://example.com -e php,html -o dirs.txt && nuclei -l dirs.txt -t cves/

Dirsearch + ffuf​

dirsearch -u https://example.com -e php -o php_dirs.txt && ffuf -u https://example.com/FUZZ -w php_dirs.txt

Dirsearch + Burp Suite​

dirsearch -u https://example.com --proxy http://127.0.0.1:8080

Dirsearch + SQLMap​

dirsearch -u https://example.com -e php -o dirs.txt && cat dirs.txt | xargs -I {} sqlmap -u {} --batch

Dirsearch + Nikto​

dirsearch -u https://example.com -o dirs.txt && nikto -h https://example.com

---

ÖRNEK TAM ZİNCİR (DIRSEARCH)​

1. Temel tarama (hızlı)​

dirsearch -u https://example.com -e php,html,txt -t 20 -o quick_scan.txt

2. Detaylı tarama (tüm extension'lar)​

dirsearch -u https://example.com -e php,html,txt,zip,bak,old,log,conf,json,xml,yml -r -R 2 -t 10 --delay 0.5 -o detailed_scan.txt

3. Sadece admin panelleri ve yönetim sayfaları​

dirsearch -u https://example.com -w /path/to/admin_wordlist.txt -e php,html -o admin_panels.txt

4. Backup dosyaları ve config'ler​

dirsearch -u https://example.com -w /path/to/backup_wordlist.txt -e bak,old,log,sql,zip,tar,gz -o backups.txt

5. API endpoint keşfi​

dirsearch -u https://example.com/api -w /path/to/api_wordlist.txt -e json,xml,php -o api_endpoints.txt

6. Zaman damgalı log​

dirsearch -u https://example.com -o "full_scan_$(date +%Y%m%d_%H%M%S).txt"

7. Tüm sonuçları birleştir​

cat quick_scan.txt detailed_scan.txt admin_panels.txt backups.txt api_endpoints.txt | sort | uniq > full_recon.txt

8. Canlı kontrol​

httpx -l full_recon.txt -o alive_endpoints.txt

9. Rapor oluştur​

echo "=== DIRSEARCH TARAMA RAPORU (date)===">finalreport.txtecho"ToplamEndpointdate)===">finalreport.txtecho"ToplamEndpointwc -l < full_recon.txt)" >> final_report.txt
echo "Canlı Endpoint: $(wc -l < alive_endpoints.txt)" >> final_report.txt
echo "----------------------------------------" >> final_report.txt
cat alive_endpoints.txt >> final_report.txt

---

KRİTİK NOTLAR (DIRSEARCH)​

• Dirsearch Python ile yazılmıştır, esnek ve özelleştirilebilirdir.
• -f (force-extensions) ile her kelimeye extension ekleyebilirsiniz.
• -O (overwrite-extensions) ile mevcut extension'ları değiştirebilirsiniz.
• %EXT% keyword ile wordlist'te dinamik extension kullanabilirsiniz.
• --filter-status, --exclude-status ile status code filtreleme yapabilirsiniz.
• --filter-length, --exclude-length ile content length filtreleme yapabilirsiniz.
• --min-response-size, --max-response-size ile boyut bazlı filtreleme yapabilirsiniz.
• --exclude-text, --include-text ile yanıt metni bazlı filtreleme yapabilirsiniz.
• --session ile taramayı kaydedip devam ettirebilirsiniz.
• --delay ile rate limit atlatabilirsiniz.
• --auto-pause ile belirli sayıda istekten sonra duraklayabilirsiniz.
• Proxy kullanımı (Burp, Tor) ile trafiği izleyebilir ve WAF'dan kaçabilirsiniz.
• Config dosyası (config.ini) ile varsayılan ayarları değiştirebilirsiniz.
• Wordlist olarak SecLists kullanmanız önerilir.
• Tüm bu işlemler YASAL ve ETİK kurallara uygun olmalıdır.

---

BÖLÜM 3: GOBUSTER VS DIRSEARCH - KARŞILAŞTIRMA​

HIZ​

• Gobuster: Go ile yazılmış, çok hızlı, düşük kaynak tüketimi
• Dirsearch: Python ile yazılmış, orta hızda, daha fazla kaynak tüketir

ESNEKLİK​

• Gobuster: 7 mod (dir, dns, vhost, s3, gcs, tftp, fuzz)
• Dirsearch: Tek mod (directory/file brute-force), ancak çok esnek filtreleme

WAF ATLATMA​

• Gobuster: Header, proxy, delay, random-agent, client-cert
• Dirsearch: Header, proxy, delay, random-agent, session yönetimi, auto-pause

FILTRELEME​

• Gobuster: Status code, content length, regex
• Dirsearch: Status code, content length, regex, size, redirect, metin, çoklu filtre

RAPORLAMA​

• Gobuster: Text, JSON (güncel sürümlerde)
• Dirsearch: Text, JSON, Markdown, CSV, Simple output

KULLANIM KOLAYLIĞI​

• Gobuster: Basit, anlaşılır, hızlı öğrenilir
• Dirsearch: Daha fazla parametre, daha karmaşık ama daha esnek

HANGİSİNİ NE ZAMAN KULLANMALI?​

• Gobuster: DNS subdomain, vhost, S3, hızlı directory tarama, performans kritikse
• Dirsearch: Detaylı directory tarama, complex filtreleme, session yönetimi, raporlama gerekiyorsa

İKİSİNİ BİRLİKTE KULLAN​

gobuster dns -d example.com -w /path/to/subdomains.txt -o subdomains.txt &&
httpx -l subdomains.txt -o alive.txt &&
cat alive.txt | while read url; do
safe_name=(echo"(echo"url" | sed 's|https?://||; s|/|_|g')
dirsearch -u "url"−ephp,html,txt,zip−o"url"−ephp,html,txt,zip−o"{safe_name}_dirs.txt"
done

---

BÖLÜM 4: WORDLIST ÖNERİLERİ​

EN İYİ WORDLIST'LER​

• SecLists: https://github.com/danielmiessler/SecLists
• Dirb common: /usr/share/wordlists/dirb/common.txt
• Dirbuster: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
• Big.txt: /usr/share/wordlists/dirb/big.txt
• Small.txt: /usr/share/wordlists/dirb/small.txt
• RockYou: /usr/share/wordlists/rockyou.txt

ÖZEL WORDLIST'LER​

• Admin panelleri: admin, adminpanel, admincp, administrator, wp-admin, manage, controlpanel, dashboard, backend, cpanel
• Backup dosyaları: backup, backup.zip, db.sql, config.old, .htaccess, .git, .svn, .env, .env.local, .gitignore
• API endpoint: api, v1, v2, api/v1, graphql, rest, restapi, swagger, openapi, docs, redoc
• Dosya extension'ları: php, html, txt, zip, bak, old, log, conf, json, xml, yml, yaml, ini, cfg, sql, csv, xls, xlsx, doc, docx, pdf, rar, 7z, tar, gz, bz2, tgz
• Sensitive dosyalar: .env, .gitignore, .htaccess, .htpasswd, robots.txt, sitemap.xml, crossdomain.xml, clientaccesspolicy.xml, web.config, application.yml
• Log dosyaları: access.log, error.log, debug.log, log.txt, app.log, audit.log, system.log
• Config dosyaları: config.php, settings.php, wp-config.php, web.config, application.yml, appsettings.json, settings.ini

WORDLIST OLUŞTURMA TEKNİKLERİ​

• CeWL: https://github.com/digininja/CeWL (site içeriğinden wordlist oluşturur)
• cupp: https://github.com/Mebus/cupp (kişisel bilgilerden wordlist)
• crunch: https://github.com/crunchsec/crunch (brute-force wordlist)
• john --wordlist: John the Ripper ile wordlist oluşturma

ÇOKLU WORDLIST KULLANIMI​

Gobuster'da cat ile birleştir​

cat wordlist1.txt wordlist2.txt > combined.txt
gobuster dir -u https://example.com -w combined.txt

Dirsearch'te doğrudan​

dirsearch -u https://example.com -w wordlist1.txt,wordlist2.txt

---

BÖLÜM 5: İLERİ DÜZEY TEKNİKLER​

1. RATE LIMIT ATLATMA​

Gobuster ile delay​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --delay 1000ms -t 5

Dirsearch ile delay​

dirsearch -u https://example.com -t 5 --delay 1

Rastgele delay​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --delay 500ms-1500ms
dirsearch -u https://example.com --delay 0.5-1.5

2. IP BAN ATLATMA​

Tor ile​

proxychains gobuster dir -u https://example.com -w /path/to/wordlist.txt -t 10
dirsearch -u https://example.com --proxy socks5://127.0.0.1:9050

Proxy listesi ile döngü​

while read proxy; do
gobuster dir -u https://example.com -w /path/to/wordlist.txt --proxy "{proxy}.txt"
sleep 2
done < proxies.txt

Dirsearch ile proxy listesi​

while read proxy; do
dirsearch -u https://example.com --proxy "{proxy}.txt"
sleep 2
done < proxies.txt

3. WAF BYPASS​

Header ekleme​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -H "X-Forwarded-For: 127.0.0.1" -H "X-Real-IP: 127.0.0.1"

Random User-Agent​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --random-agent
dirsearch -u https://example.com --random-agent

Dirsearch ile header​

dirsearch -u https://example.com -H "X-Forwarded-For: 127.0.0.1" -H "X-Real-IP: 127.0.0.1"

403 bypass için header​

gobuster dir -u https://example.com/admin -w /path/to/wordlist.txt -H "X-Forwarded-For: 127.0.0.1"

4. 403 BYPASS TEKNİKLERİ​

Header ile bypass​

gobuster dir -u https://example.com/admin -w /path/to/wordlist.txt -H "X-Forwarded-For: 127.0.0.1"

Path traversal ile bypass​

gobuster dir -u https://example.com/admin/../ -w /path/to/wordlist.txt

HTTP metodu değiştir​

dirsearch -u https://example.com/admin -X POST

Protocol değiştir (HTTP/HTTPS)​

gobuster dir -u http://example.com/admin -w /path/to/wordlist.txt

Port değiştir​

gobuster dir -u https://example.com:8080/admin -w /path/to/wordlist.txt

5. RECURSIVE TARAMA​

Gobuster​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --recursive --recursion-depth 3

Dirsearch​

dirsearch -u https://example.com -r -R 3

Recursive + extension​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -x php,html --recursive

6. PARALEL TARAMA​

Birden fazla subdomain tarama (Gobuster)​

cat subdomains.txt | xargs -P 10 -I {} gobuster dir -u https://{} -w /path/to/wordlist.txt -o {}-dirs.txt

Birden fazla URL tarama (Dirsearch)​

cat urls.txt | xargs -P 10 -I {} dirsearch -u {} -e php,html -o {}-dirs.txt

7. CONTENT LENGTH FİLTRELEME​

Gobuster (content length göster)​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -l

Dirsearch (filtreleme)​

dirsearch -u https://example.com --filter-length=1234
dirsearch -u https://example.com --exclude-length=1234,5678
dirsearch -u https://example.com --min-response-size=1024
dirsearch -u https://example.com --max-response-size=102400

8. YANIT METNİ FİLTRELEME (DIRSEARCH)​

Belirli metni içerenleri göster​

dirsearch -u https://example.com --include-text="Welcome"

Belirli metni içerenleri gizle​

dirsearch -u https://example.com --exclude-text="Not Found"
dirsearch -u https://example.com --exclude-text="404"
dirsearch -u https://example.com --exclude-text="Access Denied"

9. REDIRECT FİLTRELEME (DIRSEARCH)​

Belirli redirect'leri gizle​

dirsearch -u https://example.com --filter-redirect="https://example.com/login"
dirsearch -u https://example.com --filter-redirect="https://example.com/admin"

Redirect history göster​

dirsearch -u https://example.com --redirect-history

10. AUTOMATION SCRIPT (GELİŞTİRİLMİŞ)​

#!/bin/bash

Full recon script - DÜZELTİLMİŞ​

DOMAIN=$1
WORDLIST="/usr/share/seclists/Discovery/Web-Content/common.txt"
EXTENSIONS="php,html,txt,zip,bak,old,log,conf"

echo "[*] Starting reconnaissance for DOMAINatDOMAINat(date)"
mkdir -p "recon_DOMAIN" || exit

Subdomain discovery​

echo "[*] Subdomain discovery..."
gobuster dns -d $DOMAIN -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -t 100 -i -o subdomains.txt

Alive subdomains​

echo "[*] Checking alive subdomains..."
httpx -l subdomains.txt -o alive.txt

Directory brute-force for each alive subdomain - DÜZELTİLMİŞ​

echo "[] Directory brute-force..."
cat alive.txt | while read url; do
safe_name=(echo"(echo"url" | sed 's|https?://||; s|/|_|g')
echo "[] Scanning url"gobusterdir−u"url"gobusterdir−u"url" -w "WORDLIST"−x"WORDLIST"−x"EXTENSIONS" -t 50 -o "safenamedirs.txt"dirsearch−u"safenamedirs.txt"dirsearch−u"url" -e php,html,txt,zip -t 20 -o "${safe_name}_dirsearch.txt"
done

Virtual host discovery​

echo "[*] Virtual host discovery..."
gobuster vhost -u https://$DOMAIN -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -t 50 -o vhosts.txt

S3 bucket discovery​

echo "[*] S3 bucket discovery..."
gobuster s3 -w /usr/share/seclists/Discovery/Web-Content/bucket-names.txt -o buckets.txt

Combine results​

echo "[*] Combining results..."
cat subdomains.txt alive.txt *_dirs.txt vhosts.txt buckets.txt 2>/dev/null | sort -u > full_recon.txt

echo "[*] Recon complete at DOMAIN/"
echo "Total endpoints found: $(wc -l < full_recon.txt)"

---

BÖLÜM 7: GERÇEK DÜNYA SENARYOLARI​

SENARYO 1: BÜYÜK BİR ŞİRKETİN TÜM SUBDOMAIN'LERİNİ KEŞFETME​

1. DNS subdomain keşfi​

gobuster dns -d bigcompany.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -t 200 -i -c -o all_subdomains.txt

2. Wildcard tespiti​

gobuster dns -d bigcompany.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt --wildcard

3. Canlı kontrol​

httpx -l all_subdomains.txt -o alive_subdomains.txt

4. Her subdomain için directory tarama​

cat alive_subdomains.txt | while read url; do
safe_name=(echo"(echo"url" | sed 's|https?://||; s|/|_|g')
gobuster dir -u "{safe_name}.txt"
done

SENARYO 2: BİR API'NİN TÜM ENDPOINT'LERİNİ BULMA​

1. API endpoint keşfi​

dirsearch -u https://api.example.com -w /usr/share/seclists/Discovery/Web-Content/api-words.txt -e json,xml,php,html -t 30 -o api_endpoints.txt

2. Parametre fuzzing​

gobuster fuzz -u "https://api.example.com/v1/users?FUZZ=1" -w /usr/share/seclists/Discovery/Web-Content/api-words.txt

3. Subdomain'de API keşfi​

gobuster dns -d example.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt | grep -E "api|dev|test|stage"

SENARYO 3: ADMIN PANELİ KEŞFİ​

1. Admin wordlist ile tarama​

dirsearch -u https://example.com -w /usr/share/seclists/Discovery/Web-Content/admin-panels.txt -e php,html -t 20 -o admin_panels.txt

2. Farklı portlarda admin kontrolü​

for port in 8080 8443 8888; do
gobuster dir -u "https://example.com:$port" -w /usr/share/seclists/Discovery/Web-Content/admin-panels.txt -x php,html -t 20 -o "admin_port_$port.txt"
done

3. 403 bypass denemeleri​

gobuster dir -u https://example.com/admin -w /usr/share/seclists/Discovery/Web-Content/403-bypass.txt -H "X-Forwarded-For: 127.0.0.1" -t 20

SENARYO 4: WAF KORUMALI SİTE TARAMA​

1. WAF tespiti​

dirsearch -u https://example.com -t 5 --delay 2 -v | grep -E "403|406"

2. Rastgele User-Agent ve delay​

gobuster dir -u https://example.com -w /path/to/wordlist.txt --random-agent --delay 1000ms -t 5

3. Tor ile anonim tarama​

proxychains dirsearch -u https://example.com -w /path/to/wordlist.txt -t 5 --delay 2

4. Header ile bypass​

gobuster dir -u https://example.com -w /path/to/wordlist.txt -H "X-Forwarded-For: 127.0.0.1" -H "X-Real-IP: 127.0.0.1" -H "User-Agent: Mozilla/5.0"

SENARYO 5: SENSITIVE DOSYA KEŞFİ​

1. Config dosyaları​

gobuster dir -u https://example.com -w /usr/share/seclists/Discovery/Web-Content/config-files.txt -x php,ini,yml,yaml,xml,json,conf -t 30

2. Backup dosyaları​

dirsearch -u https://example.com -w /usr/share/seclists/Discovery/Web-Content/backup-files.txt -e bak,old,log,sql,zip,tar,gz,7z -t 20

3. Git/SVN dosyaları​

gobuster dir -u https://example.com -w /usr/share/seclists/Discovery/Web-Content/version-control.txt -t 20

---

HIZLI REFERANS KARTI​

GOBUSTER EN SIK KULLANILANLAR​

gobuster dir -u https://example.com -w wordlist.txt
gobuster dir -u https://example.com -w wordlist.txt -x php,html -t 50
gobuster dir -u https://example.com -w wordlist.txt -b 404,403 -o results.txt
gobuster dir -u https://example.com -w wordlist.txt --json -o results.json
gobuster dns -d example.com -w subdomains.txt -t 100
gobuster dns -d example.com -w subdomains.txt -i -c
gobuster vhost -u https://example.com -w vhosts.txt
gobuster fuzz -u https://example.com/FUZZ/admin -w wordlist.txt
gobuster s3 -w bucket-names.txt
gobuster dir -u https://example.com -w wordlist.txt --recursive
gobuster dir -u https://example.com -w wordlist.txt --delay 500ms
gobuster dir -u https://example.com -w wordlist.txt -H "X-Forwarded-For: 127.0.0.1"
gobuster dir -u https://example.com -w wordlist.txt --proxy http://127.0.0.1:8080
gobuster dir -u https://example.com -w wordlist.txt -k
gobuster dir -u https://example.com -w wordlist.txt -q
gobuster dir -u https://example.com -w wordlist.txt -l
gobuster dir -u https://example.com -w wordlist.txt --client-cert client.pem --client-key key.pem
gobuster dir -u https://example.com -w wordlist.txt --retry --retry-attempts 3

DIRSEARCH EN SIK KULLANILANLAR​

dirsearch -u https://example.com -w wordlist.txt
dirsearch -u https://example.com -e php,html
dirsearch -u https://example.com -t 10 --delay 0.5
dirsearch -u https://example.com -r -R 2
dirsearch -u https://example.com --filter-status=200,301
dirsearch -u https://example.com --exclude-status=404,403
dirsearch -u https://example.com --filter-length=1234
dirsearch -u https://example.com --exclude-length=1234,5678
dirsearch -u https://example.com --min-response-size=1024
dirsearch -u https://example.com --max-response-size=102400
dirsearch -u https://example.com --exclude-text="Not Found"
dirsearch -u https://example.com --include-text="Welcome"
dirsearch -u https://example.com -f -e php,html
dirsearch -u https://example.com -H "X-Forwarded-For: 127.0.0.1"
dirsearch -u https://example.com --proxy http://127.0.0.1:8080
dirsearch -u https://example.com -k
dirsearch -u https://example.com -o results.json --format json
dirsearch -u https://example.com -s session.txt
dirsearch -u https://example.com -q
dirsearch -u https://example.com --auto-pause=100
dirsearch -u https://example.com --redirect-history

Elinize emeğinize sağlık ancak gözlerim FFUF
(Fuzz Faster U Fool) aradı eklenirse çok güzel olur teşekkürler.

#Go programlama diliyle yazılmış, son derece hızlı ve açık kaynaklı bir web fuzzing (bulanıklaştırma) aracıdır. Özellikle sunucu taraflı güvenlik denetimlerinde ve sızma testlerinde (pentest) web uygulamalarının görünmeyen kısımlarını haritalamak için kullanılır.

Detaylı anlatım teşekkürler