Nibbles: Why doesn't dirb find the login page? (note: minor spoiler for Nibbles)

HTB Content Machines
,
1

The admin login page (admin.php) is in dirb’s default wordlist but when I run dirb, dirb fails to find it. what am I doing wrong? What do I need to do differently in future to find these hidden web objects?

`
root@kali:~# dirb http://10.10.10.75/nibbleblog/

DIRB v2.22
By The Dark Raver

START_TIME: Tue Jul 3 03:38:17 2018
URL_BASE: http://10.10.10.75/nibbleblog/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

GENERATED WORDS: 4612

---- Scanning URL: http://10.10.10.75/nibbleblog/ ----
==> DIRECTORY: http://10.10.10.75/nibbleblog/admin/

---- Entering directory: http://10.10.10.75/nibbleblog/admin/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode ‘-w’ if you want to scan it anyway)

---- Entering directory: http://10.10.10.75/nibbleblog/content/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode ‘-w’ if you want to scan it anyway)

---- Entering directory: http://10.10.10.75/nibbleblog/languages/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode ‘-w’ if you want to scan it anyway)

---- Entering directory: http://10.10.10.75/nibbleblog/plugins/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode ‘-w’ if you want to scan it anyway)

---- Entering directory: http://10.10.10.75/nibbleblog/themes/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.
(Use mode ‘-w’ if you want to scan it anyway)

END_TIME: Tue Jul 3 10:43:05 2018
DOWNLOADED: 4612 - FOUND: 3

root@kali:~# grep admin.php /usr/share/wordlists/dirb/common.txt
admin.php

root@kali:~# wget 10.10.10.75/nibbleblog/admin.php
–2018-07-03 11:26:32-- http://10.10.10.75/nibbleblog/admin.php
Connecting to 10.10.10.75:80… connected.
HTTP request sent, awaiting response… 200 OK
Length: 1401 (1.4K) [text/html]
Saving to: ‘admin.php’

admin.php 100%[===================>] 1.37K --.-KB/s in 0s

2018-07-03 11:26:32 (118 MB/s) - ‘admin.php’ saved [1401/1401]
`

2

dirb Niblesip /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt and why are you using the common list anyway?

3

Use dirb with -x parameter to test for files with extensions, or it’s only going to look for directories.

4

Default dirb scan found admin page for me and maybe I’m sleep deprived but looks like it found it on your output too

5

The defualt dirb found for me admin php page but i created and out put file which less the file which showed me.