{"id":20751476,"url":"https://github.com/bitsadmin/dir2json","last_synced_at":"2025-10-20T12:49:42.862Z","repository":{"id":151054994,"uuid":"615431505","full_name":"bitsadmin/dir2json","owner":"bitsadmin","description":"Tool for efficient directory enumeration","archived":false,"fork":false,"pushed_at":"2024-10-25T10:18:11.000Z","size":51,"stargazers_count":64,"open_issues_count":0,"forks_count":12,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-10-11T19:06:16.541Z","etag":null,"topics":["bash","enumeration","powershell","redteaming"],"latest_commit_sha":null,"homepage":"https://blog.bitsadmin.com/digging-for-secrets","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bitsadmin.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-03-17T17:17:41.000Z","updated_at":"2025-10-09T00:53:36.000Z","dependencies_parsed_at":null,"dependency_job_id":"7a51e80c-945b-4a3d-bff9-179d9698d484","html_url":"https://github.com/bitsadmin/dir2json","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/bitsadmin/dir2json","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bitsadmin%2Fdir2json","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bitsadmin%2Fdir2json/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bitsadmin%2Fdir2json/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bitsadmin%2Fdir2json/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bitsadmin","download_url":"https://codeload.github.com/bitsadmin/dir2json/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bitsadmin%2Fdir2json/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":280094905,"owners_count":26271003,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-20T02:00:06.978Z","response_time":62,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bash","enumeration","powershell","redteaming"],"created_at":"2024-11-17T08:33:45.570Z","updated_at":"2025-10-20T12:49:42.834Z","avatar_url":"https://github.com/bitsadmin.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Dir2json\r\nDir2json is a .NET utility which recursively lists drives or network shares storing the directory listing including various attributes in a (gzipped) .json file. Attributes that are collected are:\r\n- Name of the file or directory\r\n- Size of the file in bytes\r\n- Last Modified date of the file or directory\r\n- Attributes of the file or directory ([.NET FileAttributes](https://learn.microsoft.com/en-us/dotnet/api/system.io.fileattributes#fields))\r\n\r\nDir2json can either be executed from the commandline, or from memory in a Cobalt Strike beacon using @CCob's [BOF.NET](https://github.com/CCob/BOF.NET) where Cobalt Strike's in-memory download functionality is used to retrieve the resulting file listing.\r\n\r\nAs a .json file is not as easy to search through, the `json2csv.ps1` or `json2csv.py` scripts convert the (hierarchical) JSON structure to a (flat) CSV file which can be easily queried using PowerShell (examples in `CheatSheet.ps1`) or using tools like `grep` (examples in `CheatSheet.sh`).\r\n\r\nThis utility has been developed for use in Red Team assignments to be able to efficiently perform offline searches for interesting files and directories. At the BITSADMIN blog an in-depth article on this tool is available: [Digging for Secrets on Corporate Shares](https://blog.bitsadmin.com/blog/digging-for-secrets).\r\n\r\nLatest binaries available from the [Releases](https://github.com/bitsadmin/dir2json/releases) page.\r\n\r\n\r\n## Demos\r\n### In-memory execution in Cobalt Strike\r\n\r\n[cobaltstrike.mp4](https://blog.bitsadmin.com/assets/img/20230403_digging-for-secrets/cobaltstrike.mp4)\r\n\r\n### Convert JSON to CSV and query CSV\r\n\r\n[powershell.mp4](https://blog.bitsadmin.com/assets/img/20230403_digging-for-secrets/powershell.mp4)\r\n\r\n### Example queries\r\nA cheat sheet with various PowerShell queries generating, importing and querying the directory listing can be found in the `CheatSheet.ps1` file in this repository. Additionally, `CheatSheet.sh` is available to perform similar queries in bash.\r\n\r\n\r\n## Usage\r\n### Cobalt Strike \r\n```shell\r\nbofnet_init\r\nbofnet_load /path/to/Dir2json/Dir2json.dll\r\nbofnet_execute Dir2json.Program C:\\ cs\r\nbofnet_shutdown\r\n```\r\n\r\n### Commandline\r\n```cmd\r\ndir2json.exe C:\\ drive_C.json.gz\r\n```\r\n\r\n### Usage\r\n```\r\n== Dir2json v1.0 ==\r\nTwitter: @bitsadmin\r\nWebsite: https://github.com/bitsadmin/dir2json\r\n\r\n\r\nUsage: Dir2json.exe drive:path output [/MaxDepth=value] [/EntriesPerFile=value] [/FollowSymlinks]\r\n    drive:path\r\n            Specifies drive and/or directory\r\n\r\n    output\r\n            Output possibilities\r\n             [filename]     Save output to disk. If the .gz extension is used, it is first compressed\r\n                            E.g. dir2json.json saves JSON to disk; dir2json.json.gz, saves gzip(JSON) to disk\r\n             con            Outputs base64(gzip(JSON)) to console\r\n             conraw         Outputs JSON to console\r\n             cs             Downloads the compressed gzip to the Cobalt Strike Team Server using the\r\n                            undocumented download functionality\r\n             csraw          Downloads the plain JSON to the Cobalt Strike Team Server using the\r\n                            undocumented download functionality\r\n\r\n    [/MaxDepth=value]\r\n            Only recurses until a certain depth from the specified directory. Default: 999. Setting the value to 0\r\n            also makes it set to depth 999.\r\n\r\n    [/EntriesPerFile=value]\r\n            Maximum entries per file (x 1000). Makes sure that memory is periodically flushed. Default: 0 meaning GêP\r\n            For example 10 means that after 10.000 entries the file will be saved/downloaded and memory cleaned up.\r\n\r\n    [/FollowSymlinks]\r\n            By default symlinks are not followed because they could lead to infinite loops resulting in a crash of the\r\n            application. This flag enables following symlinks. In combination with the /MaxDepth such infinite loop can\r\n            be avoided.\r\n\r\n\r\nExamples:\r\n    Enumerate drive C and store in compressed file drive_C.json.gz in the current directory\r\n    dir2json C:\\ drive_C.json.gz\r\n\r\n    Enumerate the SYSVOL share on DC01, following sybmolic links and splitting the output in 10.000 entries per file\r\n    dir2json \\\\DC01\\SYSVOL\\ C:\\Temp\\SYSVOL.json /FollowSymlinks /MaxDepth=32 /EntriesPerFile=10\r\n\r\n    Enumerate the C:\\Users directory with maximum recursion depth of 5 and output the JSON to the console window\r\n    dir2json C:\\Users\\ conraw /MaxDepth=5\r\n\r\n\r\n    Load BOFNET and Dir2json in Cobalt Strike for in-memory execution\r\n    bofnet_init\r\n    bofnet_load /path/to/Dir2json/Dir2json.dll\r\n\r\n    Enumerate drive C splitting the output up in 100.000 entries per file, having the\r\n    resulting compressed .json.gz files downloaded to the Team Server\r\n    bofnet_execute Dir2json.Program C:\\ cs /EntriesPerFile=100\r\n\r\n    Enumerate the Backup share on MYSERVER downloading the compressed .json.gz file to the Team Server\r\n    bofnet_execute Dir2json.Program \\\\MYSERVER\\Backup\\ cs\r\n\r\n    Enumerate the C:\\Users\\bitsadmin directory and download the .json file to the Team Server\r\n    bofnet_execute Dir2json.Program C:\\Users\\bitsadmin\\ csraw\r\n\r\n    Enumerate drive X storing the output on the machine running the beacon in C:\\Temp\\Drive_X.json.gz\r\n    bofnet_execute Dir2json.Program C:\\ C:\\Temp\\Drive_X.json.gz\r\n```\r\n\r\n\r\n## Notes\r\n- Before the full directory listing is stored on disk, it is kept in memory. Even though the storage is quite efficient, on large filesystems it can use quite some memory and if the system does not have a lot of memory could lead to OutOfMemory exceptions. For that reason the `/EntriesPerFile=X` parameter is available which downloads the results thusfar and frees up memory before moving on. The `json2csv.ps1` and `json2csv.py` scripts recognize when a file has been split and merges the output back into a single .csv.\r\n- For some reason in some circumstances (which I was not able to debug because it was a client environment) executing dir2json against `C:\\` through BOF.NET just stops execution after a while without showing any message while the beacon just stays alive. In those cases the instead of collecting the files of the full `C:\\` drive, create a file listing of the different folders (e.g. `C:\\Users\\`, `\"C:\\Program Files\\\"` individually and merge the outputs later.\r\n\r\n\r\n## Future work\r\n- Support for enumeration of folders and directories on SharePoint sites (`Microsoft.SharePoint.Client` .NET namespace)\r\n- Support for the Windows registry\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbitsadmin%2Fdir2json","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbitsadmin%2Fdir2json","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbitsadmin%2Fdir2json/lists"}