aeondave/gobuster

Gobuster

Go-based brute-forcer for directories, DNS, and vhosts.

Quick Start

# Directory brute-force
gobuster dir -u http://example.com -w /usr/share/wordlists/dirb/common.txt

# DNS subdomain enumeration
gobuster dns -d example.com -w /usr/share/wordlists/subdomains.txt

# Virtual host discovery
gobuster vhost -u http://example.com -w /usr/share/wordlists/subdomains.txt

Modes

| Mode | Description | |------|-------------| | dir | Directory/file enumeration | | dns | DNS subdomain brute-force | | vhost | Virtual host discovery | | fuzz | Generic fuzzing (URL path/param) | | s3 | Enumerate open S3 buckets | | gcs | Google Cloud Storage buckets |

Dir Mode Flags

| Flag | Description | |------|-------------| | -u <url> | Target URL | | -w <wordlist> | Wordlist path | | -t <n> | Threads (default 10) | | -x <ext> | File extensions (e.g., php,html,txt) | | -s <codes> | Allowed status codes (default 200,204,301,302,307,401,403) | | -b <codes> | Blacklist status codes | | -r | Follow redirects | | -k | Skip TLS verification | | -H <header> | Custom header (e.g., "Authorization: Bearer TOKEN") | | -c <cookie> | Add cookie | | --timeout <duration> | HTTP timeout (e.g., 10s) | | -o <file> | Output file | | -q | Quiet (no banner) | | --no-error | Suppress errors | | --add-slash | Append / to each request | | -e | Expanded mode (print full URLs) | | --exclude-length <n> | Exclude responses of this length | | -n | No status codes in output |

DNS Mode Flags

| Flag | Description | |------|-------------| | -d <domain> | Target domain | | -w <wordlist> | Wordlist | | -r <resolver> | Custom DNS resolver | | --wildcard | Force continue on wildcard DNS | | --show-ips | Show IPs with results | | --show-cname | Show CNAME records |

Vhost Mode Flags

| Flag | Description | |------|-------------| | -u <url> | Base URL | | -w <wordlist> | Wordlist of subdomains | | --append-domain | Append base domain to wordlist entries | | --domain <domain> | Domain to append (if different from -u) | | --exclude-length <n> | Exclude specific response size (filter default response) |

Common Workflows

# Dir enum with extensions, output to file
gobuster dir -u https://target.com -w common.txt -x php,html,bak -o dirs.txt -q

# Dir enum behind auth
gobuster dir -u https://target.com -w common.txt -H "Authorization: Bearer <token>"

# Recursive-style: pipe back interesting dirs
gobuster dir -u https://target.com/api/ -w api-endpoints.txt -x json

# DNS with custom resolver
gobuster dns -d target.com -w subdomains-top1m.txt -r 8.8.8.8 -t 50

# Vhost discovery (append domain for non-matching)
gobuster vhost -u http://target.com -w subdomains.txt --append-domain

# Vhost — filter out default response size
gobuster vhost -u http://target.com -w subdomains.txt --append-domain --exclude-length 12345

# S3 bucket enumeration
gobuster s3 -w bucket-names.txt

# Fuzz mode (generic, FUZZ in URL)
gobuster fuzz -u https://target.com/FUZZ -w wordlist.txt -b 404

Useful Wordlists

• /usr/share/wordlists/dirb/common.txt — general dirs
• /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt — comprehensive
• SecLists/Discovery/Web-Content/raft-medium-directories.txt — raft lists
• SecLists/Discovery/DNS/subdomains-top1million-5000.txt — DNS

Resources

| File | When to load | |------|--------------| | references/wordlists.md | Recommended wordlists per mode and target type |