Gobuster Guide
This is a simple English guide for using Gobuster in penetration testing.
This is a simple English guide for using Gobuster in penetration testing.
What is Gobuster?#
Gobuster is an open-source tool written in Go. It is used to brute-force and enumerate:
- Web directories and files
- DNS subdomains
- Virtual hosts
- Amazon S3 buckets
- Google Cloud Storage buckets
Security professionals use it during penetration tests, bug bounty hunting, and security assessments. Gobuster is often used during the reconnaissance and scanning phases.
Key Concepts#
Enumeration is listing all available resources, even if they are hidden or not easily accessible. Example: listing website directories.
Brute Force is trying many possible values until one works. Gobuster uses wordlists for this purpose.
Modes of Gobuster#
Gobuster has different modes for different use cases.
1. Directory and File Enumeration (dir mode)#
This mode finds website directories and files using a wordlist.
Command example:
gobuster dir -u "http://example.thm" -w /path/to/wordlistExplanation:
dir: Directory and file enumeration mode-u: Target URL-w: Path to the wordlist
Advanced example with extensions and redirects:
gobuster dir -u "http://example.thm" -w /path/to/wordlist -x .php,.js -r-x: File extensions to look for (e.g. .php, .js)-r: Follow redirects
2. DNS Subdomain Enumeration (dns mode)#
This mode brute-forces DNS subdomains for a target domain.
Command example:
gobuster dns -d example.thm -w /path/to/wordlistExplanation:
dns: DNS subdomain enumeration mode-d: Target domain-w: Path to the wordlist
Example usage:
gobuster dns -d example.thm -w /usr/share/wordlists/subdomains.txtThis command tries each word in the wordlist as a possible subdomain.
3. Virtual Host Enumeration (vhost mode)#
This mode finds virtual hosts on the same server.
Command example:
gobuster vhost -u "http://example.thm" -w /path/to/wordlistExplanation:
vhost: Virtual host enumeration mode-u: Target URL or IP-w: Path to the wordlist
Advanced example:
gobuster vhost -u "http://10.10.12.201" --domain example.thm -w /path/to/wordlist --append-domain --exclude-length 250-320--domain: Sets the domain for the Host header--append-domain: Appends the domain to each word in the wordlist--exclude-length: Excludes responses of certain sizes (to reduce false positives)
Common Flags#
|
A simple table of common Gobuster flags with clear descriptions.
| Short Flag | Long Flag | Description |
|---|---|---|
| -c | --cookies | Adds a cookie to each request (e.g., session ID). |
| -x | --extensions | Specifies file extensions to look for (e.g., .php, .js). |
| -H | --headers | Adds custom headers to each request. |
| -k | --no-tls-validation | Skips TLS certificate validation (useful for self-signed certs). |
| -n | --no-status | Hides status codes in output to make it cleaner. |
| -P | password | Password for authenticated requests (use with --username). |
| -s | --status-codes | Show only specific status codes (e.g., 200 or 300-400). |
| -b | --status-codes-blacklist | Exclude specific status codes from the output. |
| -U | --username | Username for authenticated requests (use with --password). |
| -r | --followredirect | Follows HTTP redirects (301, 302). |
| -t | --threads | Sets the number of threads for the scan (default is 10). |
| -w | --wordlist | Path to the wordlist to use. |
| --delay | Sets delay between requests to avoid detection. | |
| --debug | Enables debug output for troubleshooting. | |
| -o | --output | Writes results to a specified output file. |
Example Commands#
Directory Enumeration:
gobuster dir -u "http://www.example.thm/" -w /usr/share/wordlists/dirb/small.txt -t 64DNS Subdomain Enumeration:
gobuster dns -d example.thm -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txtVirtual Host Enumeration:
gobuster vhost -u "http://10.10.12.201" --domain example.thm -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain --exclude-length 250-320Tips#
- Always include the protocol (http:// or https://) in the URL.
- Choose the right wordlist for the target.
- Adjust the number of threads for better performance.
- Use exclude-length to reduce false positives.
- Gobuster does not scan recursively into subdirectories automatically. If you find a new path, you must scan it separately.
Disclaimer#
This guide is for educational and authorized penetration testing only. Do not use it on systems you do not have permission to test.