Need help with rustbuster?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

phra
330 Stars 42 Forks GNU General Public License v3.0 300 Commits 14 Opened issues

Description

A Comprehensive Web Fuzzer and Content Discovery Tool

Services available

!
?

Need anything else?

Contributors list

# 31,813
Ruby
angular...
fuzz
python3
264 commits
# 520,432
Shell
HTML
CSS
14 commits

rustbuster CircleCI

A Comprehensive Web Fuzzer and Content Discovery Tool

asciicast

Introduction

Check the blog post: Introducing Rustbuster — A Comprehensive Web Fuzzer and Content Discovery Tool

Download

You can download prebuilt binaries from here.

Installation

install_rustbuster() {
    echo "Installing latest version of Rustbuster"
    latest_version=`curl -s https://github.com/phra/rustbuster/releases | grep "rustbuster-v" | head -n1 | cut -d'/' -f6`
    echo "Latest release: $latest_version"
    mkdir -p /opt/rustbuster
    wget -qP /opt/rustbuster https://github.com/phra/rustbuster/releases/download/$latest_version/rustbuster-$latest_version-x86_64-unknown-linux-gnu
    ln -fs /opt/rustbuster/rustbuster-$latest_version-x86_64-unknown-linux-gnu /opt/rustbuster/rustbuster
    chmod +x /opt/rustbuster/rustbuster
    echo "Done! Try running"
    echo "/opt/rustbuster/rustbuster -h"
}

install_rustbuster

Usage

rustbuster 2.1.0
DirBuster for rust

USAGE: rustbuster [SUBCOMMAND]

FLAGS: -h, --help Prints help information -V, --version Prints version information

SUBCOMMANDS: dir Directories and files enumeration mode dns A/AAAA entries enumeration mode fuzz Custom fuzzing enumeration mode help Prints this message or the help of the given subcommand(s) vhost Virtual hosts enumeration mode tilde IIS 8.3 shortname enumeration mode

EXAMPLES: 1. Dir mode: rustbuster dir -u http://localhost:3000/ -w examples/wordlist -e php 2. Dns mode: rustbuster dns -d google.com -w examples/wordlist 3. Vhost mode: rustbuster vhost -u http://localhost:3000/ -w examples/wordlist -d test.local -x "Hello" 4. Fuzz mode: rustbuster fuzz -u http://localhost:3000/login
-X POST
-H "Content-Type: application/json"
-b '{"user":"FUZZ","password":"FUZZ","csrf":"CSRFCSRF"}'
-w examples/wordlist
-w /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-10000.txt
-s 200
--csrf-url "http://localhost:3000/csrf"
--csrf-regex '{"csrf":"(\w+)"}' 5. Tilde mode: rustbuster tilde -u http://localhost:3000/ -e aspx -X OPTIONS

dir
usage

rustbuster-dir
Directories and files enumeration mode

USAGE: rustbuster dir [FLAGS] [OPTIONS] --url --wordlist ...

FLAGS: -f, --append-slash Tries to also append / to the base request -K, --exit-on-error Exits on connection errors -h, --help Prints help information -k, --ignore-certificate Disables TLS certificate validation --no-banner Skips initial banner --no-progress-bar Disables the progress bar -V, --version Prints version information -v, --verbose Sets the level of verbosity

OPTIONS: -e, --extensions Sets the extensions [default: ] -b, --http-body Uses the specified HTTP method [default: ] -H, --http-header ... Appends the specified HTTP header -X, --http-method Uses the specified HTTP method [default: GET] -S, --ignore-status-codes Sets the list of status codes to ignore [default: 404] -s, --include-status-codes Sets the list of status codes to include [default: ] -o, --output Saves the results in the specified file [default: ] -t, --threads Sets the amount of concurrent requests [default: 10] -u, --url Sets the target URL -a, --user-agent Uses the specified User-Agent [default: rustbuster] -w, --wordlist ... Sets the wordlist

EXAMPLE: rustbuster dir -u http://localhost:3000/ -w examples/wordlist -e php

dns
usage

rustbuster-dns
A/AAAA entries enumeration mode

USAGE: rustbuster dns [FLAGS] [OPTIONS] --domain --wordlist ...

FLAGS: -K, --exit-on-error Exits on connection errors -h, --help Prints help information --no-banner Skips initial banner --no-progress-bar Disables the progress bar -V, --version Prints version information -v, --verbose Sets the level of verbosity

OPTIONS: -d, --domain Uses the specified domain -o, --output Saves the results in the specified file [default: ] -t, --threads Sets the amount of concurrent requests [default: 10] -w, --wordlist ... Sets the wordlist

EXAMPLE: rustbuster dns -d google.com -w examples/wordlist

vhost
usage

rustbuster-vhost 
Virtual hosts enumeration mode

USAGE: rustbuster vhost [FLAGS] [OPTIONS] --domain --ignore-string ... --url --wordlist ...

FLAGS: -K, --exit-on-error Exits on connection errors -h, --help Prints help information -k, --ignore-certificate Disables TLS certificate validation --no-banner Skips initial banner --no-progress-bar Disables the progress bar -V, --version Prints version information -v, --verbose Sets the level of verbosity

OPTIONS: -d, --domain Uses the specified domain to bruteforce -b, --http-body Uses the specified HTTP body [default: ] -H, --http-header ... Appends the specified HTTP header -X, --http-method Uses the specified HTTP method [default: GET] -S, --ignore-status-codes Sets the list of status codes to ignore [default: 404] -x, --ignore-string ... Ignores results with specified string in the HTTP body -s, --include-status-codes Sets the list of status codes to include [default: ] -o, --output Saves the results in the specified file [default: ] -t, --threads Sets the amount of concurrent requests [default: 10] -u, --url Sets the target URL -a, --user-agent Uses the specified User-Agent [default: rustbuster] -w, --wordlist ... Sets the wordlist

EXAMPLE: rustbuster vhost -u http://localhost:3000/ -w examples/wordlist -d test.local -x "Hello"

fuzz
usage

rustbuster-fuzz
Custom fuzzing enumeration mode

USAGE: rustbuster fuzz [FLAGS] [OPTIONS] --url --wordlist ...

FLAGS: -K, --exit-on-error Exits on connection errors -h, --help Prints help information -k, --ignore-certificate Disables TLS certificate validation --no-banner Skips initial banner --no-progress-bar Disables the progress bar -V, --version Prints version information -v, --verbose Sets the level of verbosity

OPTIONS: --csrf-header ... Adds the specified headers to CSRF GET request --csrf-regex Grabs the CSRF token applying the specified RegEx --csrf-url Grabs the CSRF token via GET to csrf-url -b, --http-body Uses the specified HTTP method [default: ] -H, --http-header ... Appends the specified HTTP header -X, --http-method Uses the specified HTTP method [default: GET] -S, --ignore-status-codes Sets the list of status codes to ignore [default: 404] -x, --ignore-string ... Ignores results with specified string in the HTTP Body -s, --include-status-codes Sets the list of status codes to include [default: ] -i, --include-string ... Includes results with specified string in the HTTP body -o, --output Saves the results in the specified file [default: ] -t, --threads Sets the amount of concurrent requests [default: 10] -u, --url Sets the target URL -a, --user-agent Uses the specified User-Agent [default: rustbuster] -w, --wordlist ... Sets the wordlist

EXAMPLE: rustbuster fuzz -u http://localhost:3000/login
-X POST
-H "Content-Type: application/json"
-b '{"user":"FUZZ","password":"FUZZ","csrf":"CSRFCSRF"}'
-w examples/wordlist
-w /usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-10000.txt
-s 200
--csrf-url "http://localhost:3000/csrf"
--csrf-regex '{"csrf":"(\w+)"}'

tilde
usage

rustbuster-tilde
IIS 8.3 shortname enumeration mode

USAGE: rustbuster tilde [FLAGS] [OPTIONS] --url

FLAGS: -K, --exit-on-error Exits on connection errors -h, --help Prints help information -k, --ignore-certificate Disables TLS certificate validation --no-banner Skips initial banner --no-progress-bar Disables the progress bar -V, --version Prints version information -v, --verbose Sets the level of verbosity

OPTIONS: -e, --extension Sets the redirect extension -b, --http-body Uses the specified HTTP body [default: ] -H, --http-header ... Appends the specified HTTP header -X, --http-method Uses the specified HTTP method [default: GET] -S, --ignore-status-codes Sets the list of status codes to ignore [default: 404] -s, --include-status-codes Sets the list of status codes to include [default: ] -o, --output Saves the results in the specified file [default: ] -t, --threads Sets the amount of concurrent requests [default: 10] -u, --url Sets the target URL -a, --user-agent Uses the specified User-Agent [default: rustbuster]

EXAMPLE: rustbuster tilde -u http://localhost:3000/ -e aspx -X OPTIONS

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.