gobuster

Gobuster

Overview

Gobuster is a multi-threaded brute-force tool written in Go. Modes: dir (directories and files), dns (subdomains), vhost (virtual hosts), fuzz (replace the FUZZ keyword anywhere in URL, headers or body), s3 and gcs (cloud buckets), and tftp. It finds admin panels, backup files, forgotten endpoints and unlisted hosts.

Only run it against systems you own or have written permission to test. It sends thousands of requests and shows up in logs.

Instructions

Install

sudo apt install gobuster                    # Debian/Kali; or: brew install gobuster
go install github.com/OJ/gobuster/v3@latest  # needs Go 1.25+

Release binaries (gobuster_Linux_x86_64.tar.gz etc.) are on the GitHub releases page next to gobuster_<version>_checksums.txt; verify with sha256sum -c before extracting. Check the version with gobuster --version.

Directory and file discovery

# Basic scan
gobuster dir -u http://127.0.0.1:8080 -w /usr/share/wordlists/dirb/common.txt

# Extensions, more threads, only interesting status codes
gobuster dir -u http://127.0.0.1:8080 \
  -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
  -x php,txt,bak,old,sql,zip,env -t 30 \
  -s 200,204,301,302,307,401,403 -b ""

# Authenticated, saved to a file, errors hidden
gobuster dir -u http://127.0.0.1:8080/api/v1 -w api-endpoints.txt \
  -H "Authorization: Bearer $API_TOKEN" -c "session=$SESSION_ID" \
  --no-error -o results.txt

Key flags: -x extensions, -X extensions file, -t threads (default 10), -s allowed status codes, -b blocked status codes, --xl exclude body lengths, -e print full URLs, -r follow redirects, -k skip TLS verification, -a user agent, -d per-thread delay (for example 500ms), --db look for backup copies of found files, -q and --np for clean output.

Gobuster 3.x blocks status 404 by default (-b 404) and refuses to start if -s is also set. Pass -b "" together with -s, or use -b alone. There is no recursive mode in v3: rerun against each interesting directory.

DNS subdomains

gobuster dns --do staging.northwind.dev \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  --resolver 1.1.1.1:53 -t 30

The domain flag is --domain / --do; in dns mode -d is the delay and -d northwind.dev fails with a parse error. Use -c to also check CNAMEs and --wc to continue when a wildcard record is detected (results will then be noise).

Virtual hosts

gobuster vhost -u http://10.10.14.5 --domain northwind.dev --append-domain \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  --xl 11234

When the URL is an IP address, set --domain so the Host header is built correctly. --xl hides responses of the default page's length; --xh adjusts for hostnames that change the length.

Buckets and fuzzing

gobuster s3 -w northwind-bucket-names.txt        # also: gobuster gcs -w ...
gobuster fuzz -u "http://127.0.0.1:8080/search?q=FUZZ" -w params.txt -b 404 --exclude-length 0

Examples

Example 1: Find leftover files on your staging site

User prompt: "Scan our staging app at http://127.0.0.1:8080 for forgotten backup or config files."

gobuster dir -u http://127.0.0.1:8080 \
  -w /usr/share/seclists/Discovery/Web-Content/common.txt \
  -x zip,bak,sql --np -q

Result (each line is path, status, size):

admin                (Status: 301) [Size: 0] [--> /admin/]
backup.zip           (Status: 200) [Size: 2481530]
.env                 (Status: 200) [Size: 412]

backup.zip and .env served with 200 are findings to remove; check the 301 directories by hand.

Example 2: Enumerate subdomains of a domain you own

User prompt: "List the subdomains of northwind.dev that resolve."

gobuster dns --do northwind.dev -w subdomains-top1million-5000.txt -t 30 -o subdomains.txt -q

Result: one line per hit, for example staging.northwind.dev and grafana.northwind.dev. If the tool stops with a wildcard warning, the zone answers every name; use vhost mode against the web server instead.

Guidelines

• Get written authorization first; set -t and -d so you do not take a service down.
• Pick the wordlist to fit the target (SecLists Discovery/Web-Content, Discovery/DNS); start small, then widen.
• A 403 confirms the path exists. Servers that answer 200 for everything need --xl or -b filters; gobuster warns about this and --force overrides the check, which is rarely wise.
• Older tutorials use -l, -d domain or --show-ips; these flags do not exist in v3.8 (length is printed by default; hide it with --hl).
• Keep API tokens in environment variables, not in shell history.
• Save output (-o) and combine with an Nmap scan of discovered hosts.