spray-dir-brute

spray Directory Brute-Forcing Methodology

spray is a high-performance directory brute-forcing tool developed by chainreactors, with core advantages:Smart Filtering(automatically identifies invalid responses) + Extreme Performance(far surpassing ffuf in multi-target scenarios) + Fingerprinting(integrates gogo/fingerprinthub/wappalyzer fingerprint libraries).

Project address:https://github.com/chainreactors/spray

Phase 1: Basic Directory Brute-Forcing

# 从字典爆破（最常用）
spray -u http://target -d wordlist.txt

# 多字典组合
spray -u http://target -d wordlist1.txt -d wordlist2.txt

# 指定后缀
spray -u http://target -d wordlist.txt --suffix .php,.jsp,.asp

Batch Targets

spray -l urls.txt -d wordlist.txt

### 常用字典路径（/pentest 目录）

```bash
# aboutsecurity 字典库
/pentest/AboutSecurity/Dic/web/directory/common.txt
/pentest/AboutSecurity/Dic/web/directory/php/php.txt
/pentest/AboutSecurity/Dic/web/ctf/param.txt

# spray 自带字典会自动加载

Phase 2: Mask Dictionary Generation

spray supports hashcat-like mask syntax, with no need to pre-generate dictionaries:

# 掩码: ?l=小写 ?u=大写 ?d=数字 ?s=特殊字符
# 爆破 /backup_XXXX.zip（4 位数字）
spray -u http://target -w "/backup_{?d#4}.zip"

# 爆破 /api/v1 到 /api/v9
spray -u http://target -w "/api/v{?d#1}"

# 组合路径
spray -u http://target -w "/{?l#3}/{?l#4}.php"

Phase 3: Smart Filtering

spray's core advantage—automatically filters invalid responses, reducing manual screening:

# 智能过滤（自动检测 404 页面特征并过滤）
spray -u http://target -d wordlist.txt --smart

# 按状态码过滤
spray -u http://target -d wordlist.txt --match-status 200,301,302,403

# 按响应长度过滤（排除统一错误页面）
spray -u http://target -d wordlist.txt --filter-length 1234

# 按关键词过滤
spray -u http://target -d wordlist.txt --match-string "admin"

Phase 4: Fingerprinting Mode

spray integrates three major fingerprint libraries: gogo, fingerprinthub, and wappalyzer:

# check-only 模式：只做指纹识别（类似 httpx）
spray -l urls.txt --check-only

# 启用拓展指纹（主动探测 + 第三方指纹库）
spray -u http://target --finger

# 爆破 + 指纹识别
spray -u http://target -d wordlist.txt --finger

Phase 5: Backup Files and Common Files

# 扫描备份文件（.bak, .zip, .tar.gz, .sql 等）
spray -u http://target --bak

# 扫描常见通用文件（robots.txt, .git, .env 等）
spray -u http://target --common

# 全功能扫描（爆破 + 备份 + 常见文件 + 爬虫 + 指纹）
spray -u http://target -a

Phase 6: Advanced Usage

# 启用爬虫（从页面中提取更多路径）
spray -u http://target --crawl

# 断点续传（中断后继续）
spray --resume stat.json

# 自定义 Header
spray -u http://target -d wordlist.txt -H "Cookie: session=xxx"

# 使用代理
spray -u http://target -d wordlist.txt --proxy http://127.0.0.1:8080

# 控制并发
spray -u http://target -d wordlist.txt -t 50

Comparison with ffuf for Decision-Making

Scenario	Recommended Tool	Reason
Single-target directory brute-forcing	Either spray or ffuf works	Little performance difference
Batch multi-target	spray	Batch performance far exceeds ffuf
Parameter Fuzzing	ffuf	FUZZ placeholder is more flexible
Backup file scanning	spray	--bak One-click scanning
Fingerprinting	spray	Built-in three major fingerprint libraries
Need mask dictionaries	spray	Built-in mask generation