Although Nikto can identify potentially sensitive directories and web server misconfigurations, its primary purpose is not to find hidden files. DirBuster, however, exists entirely to find the hidden files and directories on web servers. Using Java (so the Java Runtime Environment must be installed), DirBuster can send many, many requests to a web server in order to completely enumerate any directories that may be interesting to any sort of an assessor. From a self-testing perspective, running DirBuster can be very useful to verify that there are no sensitive files left on your own web server!

Technically, DirBuster as a stand-alone product is considered as end of life by OWASP, the organization that runs the project. The codebase has been ported to the OWASP Zed Attack Proxy (ZAP) project (which we'll talk about in the next section), but DirBuster can still be run in stand-alone mode—which is very common in the information security consulting...