For example:


I know that xxxx is a number between 1-9000. How to brute force the range?

migrated from security.stackexchange.com Dec 14 '18 at 13:43

This question came from our site for information security professionals.

  • I have no idea what you're asking. Can you be more specific? – forest Dec 14 '18 at 4:05
  • What do you want to do with the range? Do you want to see if any page in the range exists? – schroeder Dec 14 '18 at 9:13
  • 1
    The question is more about how to do something on a computer than about security. A security question is rather "is it achievable to brute force 9000 entries" or "how to protect against url brute forcing". A question for superuser would be "how do I request all these URLs" (that is what you are asking), or a question for server fault would be "how do I configure <some web server> to limit requests?". I hope this helps make the difference between the sites more clear! I've voted to move the question to superuser, which I think is a better fit. – Luc Dec 14 '18 at 13:39

It isn't clear what you want to achieve by bruteforcing that range. That being said, the iteration process can be achieved with cURL alone.

curl -s "http://example.com/[1-9000].php"

Have a look at DirBuster. "DirBuster is a multi threaded java application designed to brute force directories and files names on web/application servers." It is pretty simple to set up a repeating attack like you describe.

The DirBuster tool is still available and comes with the kali distros, but the project's home page now says it's now been deprecated in favor of a newer tool, ZAP. ZAP looks like it has a lot more features; but I've never used it or figured out how to make it attack in the way you're asking.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy