gobuster

Brute-forces hidden paths on web servers and more.

TLDR

Discover directories and files that match in the wordlist

$ gobuster dir --url [https://example.com/] --wordlist [path/to/file]

Discover subdomains

$ gobuster dns --domain [example.com] --wordlist [path/to/file]

Discover other virtual hosts on the server

$ gobuster vhost --url [https://example.com/] --wordlist [path/to/file]

Fuzz the value of a parameter

$ gobuster fuzz --url [https://example.com/?parameter=FUZZ] --wordlist [path/to/file]

Fuzz the name of a parameter

$ gobuster fuzz --url [https://example.com/?FUZZ=value] --wordlist [path/to/file]

Usage:
  gobuster [command]

Available Commands:
  dir         Uses directory/file enumeration mode
  dns         Uses DNS subdomain enumeration mode
  fuzz        Uses fuzzing mode
  help        Help about any command
  s3          Uses aws bucket enumeration mode
  version     shows the current version
  vhost       Uses VHOST enumeration mode

Flags:
      --delay duration    Time each thread waits between requests (e.g. 1500ms)
  -h, --help              help for gobuster
      --no-error          Don't display errors
  -z, --no-progress       Don't display progress
  -o, --output string     Output file to write results to (defaults to stdout)
  -p, --pattern string    File containing replacement patterns
  -q, --quiet             Don't print the banner and other noise
  -t, --threads int       Number of concurrent threads (default 10)
  -v, --verbose           Verbose output (errors)
  -w, --wordlist string   Path to the wordlist

Use "gobuster [command] --help" for more information about a command.