Search code examples
brute-forcesubdirectoryzap

Enumerating Subdirectories Using ZAP

I am using ZAP 2.7.0 and I would like to enumerate possible files/directories within a subdirectory of a given site. There is the DirBuster tool, which is not available in the market place anymore. However, ZAP implements the "forced browsing" functionality that is to be used in combination with a dictionary file.

I am able to use forced browsing for a given site abc.com. However, I only want to apply it to a subdirectory abc.com/subdir1/. How can this be done?

Solution

  • ZAP actually uses (and maintains) a fork of the DirBuster code for forced browsing, so its actually the same thing.

    To force browse a subdirectory:

    1. Navigate to that subdirectory in a browser proxying through ZAP
    2. Find the subdirectory in the ZAP Sites tree
    3. Right click on it
    4. Select either:
      • Attack -> Forced Browse Directory
      • Attack -> Forced Browse Directory (and children)