A blazing-fast web directory scanner written in C++. HTTP/2, multi-threading, connection pooling. Faster than Gobuster.
Leverages HTTP/2 multiplexing and connection pooling to maximize throughput. Requests fly.
Configurable thread count with auto-calibration. Spin up 100+ threads and let it rip.
Pass session cookies to scan authenticated pages. Supports PHPSESSID, JWT, and any cookie format.
Append extensions like php,html,bak to every wordlist entry in one pass.
Save all discovered paths to a file for later analysis and reporting.
Real-time progress bar with req/s counter. Always know where you are.
Clone the repo, build with g++ and libcurl, and start scanning. Or grab the Windows binary below.
↓ BASHER.EXE — WindowsBasher is a high-performance web directory brute forcer written in C++. It uses HTTP/2, multi-threading, and connection pooling to scan targets faster than tools like Gobuster or Dirb.
The fastest way to get started on Windows is to download the prebuilt binary from the GitHub releases page.
For Linux and macOS, build from source (see below).
You'll need g++ and libcurl installed.
On Windows, install MinGW-w64 (includes g++) and download the libcurl dev package.
On Linux/macOS, install via package manager:
Two flags are required: -u (target URL) and -w (wordlist path). All others are optional.
| Flag | Type | Description |
|---|---|---|
| -u <url> | required |
Target URL to brute force. Include the scheme (http:// or https://).
|
| -w <path> | required |
Path to wordlist file. One entry per line. Included wordlists live in
wordlists/. |
| Flag | Type | Description |
|---|---|---|
| -T <n> | optional |
Number of concurrent threads.
Default: 1
|
| -c <cookie> | optional |
Cookie string to include with every request. Use for authenticated scanning.
Example: "PHPSESSID=abc123"
|
| -o <file> | optional |
Output file path. Discovered paths are written here, one per line.
Example: results.txt
|
| -x <exts> | optional |
Comma-separated list of file extensions to append to each wordlist entry.
Example: php,html,bak
|
Use -c to pass a cookie string with every request. This lets you scan areas of a site that require authentication.
Grab your session cookie from your browser's DevTools (F12 → Application → Cookies), then pass it to Basher:
The -x flag appends file extensions to each wordlist entry. For a wordlist entry admin with -x php,html, Basher will try:
Useful for finding backup files (bak), configuration files (conf), or specific technologies.
Use -o to save all discovered paths to a file. Only paths that return non-404 responses are written.
Built by Adam Abed (Nullit13) · Source on GitHub →