gobuster

Directory and DNS brute-forcing tool

TLDR

Directory brute-force

$ gobuster dir -u [https://example.com] -w [wordlist.txt]

DNS subdomain enumeration

$ gobuster dns -d [example.com] -w [subdomains.txt]

Vhost discovery

$ gobuster vhost -u [https://example.com] -w [wordlist.txt]

With file extensions

$ gobuster dir -u [https://example.com] -w [wordlist.txt] -x [php,html,txt]

With custom threads

$ gobuster dir -u [https://example.com] -w [wordlist.txt] -t [50]

Follow redirects

$ gobuster dir -u [https://example.com] -w [wordlist.txt] -r

gobuster is a fast directory and DNS brute-forcing tool written in Go. It discovers hidden directories, files, and subdomains through wordlist-based enumeration.The tool is designed for web application security testing, helping identify hidden content that may reveal vulnerabilities or sensitive information. It supports multiple modes including directory enumeration, DNS subdomain brute-forcing, and virtual host discovery.

PARAMETERS

dir

Directory/file brute-forcing mode.

dns

DNS subdomain enumeration mode.

vhost

Virtual host discovery mode.

fuzz

Generic fuzzing mode using a FUZZ keyword placeholder in the URL, headers, or body.

Enumerate open Amazon S3 buckets.

gcs

Enumerate open Google Cloud Storage buckets.

tftp

Enumerate files on a TFTP server.

-u url

Target URL.

-w file

Wordlist file.

-t n

Number of threads.

-x extensions

File extensions to search.

-r

Follow redirects.

-k

Skip TLS certificate verification.

-o file

Output file.

-s codes

Status codes to consider valid.

-b codes

Status codes to blacklist.

INSTALL

sudo apt install gobuster

sudo dnf install gobuster

sudo pacman -S gobuster

brew install gobuster

nix profile install nixpkgs#gobuster

CAVEATS

Only for authorized security testing. May trigger WAF rules. Large wordlists slow on remote hosts. Respect rate limits.

HISTORY

gobuster was created by OJ Reeves as a fast alternative to tools like DirBuster. Written in Go for concurrency and performance, it became a standard tool in penetration testing and bug bounty hunting.

RESOURCES

Source code