---
name: "dirsearch-web-path-bruteforce"
description: "Discover hidden directories, backup archives, and unlinked admin portals with dirsearch."
metadata:
  author: "Maurosoria"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "find hidden endpoints dirsearch"
  - "brute force web directories"
  - "discover backup files dirsearch"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# dirsearch Advanced Web Path & Endpoint Brute-Forcer

Discovers web application paths with dirsearch: multi-threaded HTTP probing, recursive dictionary searches, status code filtering, custom wordlists, and extension permutations (.php, .bak, .json).

## When to Invoke
Invoke this skill whenever you need to:
- find hidden endpoints dirsearch
- brute force web directories
- discover backup files dirsearch

## Execution SOP & Rules
1. Execute dirsearch -u https://target.com -e php,html,js,json,bak -i 200,301,302,403.
2. Use -t 30 to configure thread concurrency without triggering web application firewalls.
3. Inspect discovered sensitive paths and restrict access via web server configuration.
4. Ensure scans are restricted strictly to authorized test domains.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.