Gobuster

Gobuster — Fast brute-force enumeration tool written in Go (v3.8.2, Sep 2025). Authors: OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart). Capabilities: directory/file, DNS subdomain, virtual host, S3 bucket, GCS bucket, TFTP, and generic fuzzing enumeration.

Installation

# Kali Linux (pre-installed in default metapackage)
sudo apt install gobuster

# Go install (requires Go 1.24+)
go install github.com/OJ/gobuster/v3@latest

# Build from source
git clone https://github.com/OJ/gobuster.git
cd gobuster
go mod tidy
go build

# Docker
docker pull ghcr.io/oj/gobuster:latest
docker run --rm -it ghcr.io/oj/gobuster:latest dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt

Modes Overview

# Getting help
gobuster -h                  # General help
gobuster help dir            # Help for a specific mode
gobuster dir --help          # Alternative help syntax

Global Flags (Apply to All Modes)

Note — v3.7+ CLI changes: From v3.7 onwards, Gobuster switched to a new CLI library. The --verbose flag was replaced by --debug. Some short flags were also reassigned. Always check gobuster <mode> --help on your installed version.

1. Directory & File Enumeration (dir)

The most commonly used mode. Brute-forces URIs (directories and files) on web servers.

All dir Mode Flags

Practical Examples

# Basic directory enumeration
gobuster dir -u http://10.10.10.100 -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

# Search for specific file extensions
gobuster dir -u http://10.10.10.100 -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt \
  -x php,html,txt,bak,old,conf,xml,json

# Extensions loaded from a file
gobuster dir -u http://10.10.10.100 -w /usr/share/wordlists/dirb/common.txt \
  -X /home/kali/extensions.txt

# With authentication cookie (e.g. post-login enumeration)
gobuster dir -u http://10.10.10.100 -w /usr/share/wordlists/dirb/big.txt \
  -c "PHPSESSID=abc123def456" -x php

# HTTP Basic Auth
gobuster dir -u http://10.10.10.100 -w /usr/share/wordlists/dirb/common.txt \
  -U admin -P password123

# Custom header (e.g. JWT / Bearer token)
gobuster dir -u http://10.10.10.100/api -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

# Follow redirects and skip TLS errors
gobuster dir -u https://10.10.10.100 -w /usr/share/wordlists/dirb/common.txt -r -k

# Proxy through Burp Suite
gobuster dir -u http://10.10.10.100 -w /usr/share/wordlists/dirb/common.txt \
  --proxy http://127.0.0.1:8080

# SOCKS5 proxy (e.g. through ligolo-ng or SSH tunnel)
gobuster dir -u http://172.16.1.10 -w /usr/share/wordlists/dirb/common.txt \
  --proxy socks5://127.0.0.1:1080

# Filter false positives by excluding response lengths
gobuster dir -u http://10.10.10.100 -w /usr/share/wordlists/dirb/common.txt \
  --exclude-length 0,4523

# Only show specific status codes (supports ranges)
gobuster dir -u http://10.10.10.100 -w /usr/share/wordlists/dirb/common.txt \
  -s 200,301,302

# Blacklist status codes
gobuster dir -u http://10.10.10.100 -w /usr/share/wordlists/dirb/common.txt \
  -b 403,404

# Random user agent to evade basic fingerprinting
gobuster dir -u http://10.10.10.100 -w /usr/share/wordlists/dirb/common.txt \
  --random-agent

# High threads with rate limiting
gobuster dir -u http://10.10.10.100 -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt \
  -t 50 --delay 100ms

# Auto-discover backup files alongside regular enumeration
gobuster dir -u http://10.10.10.100 -w /usr/share/wordlists/dirb/common.txt -d

# POST method enumeration
gobuster dir -u http://10.10.10.100 -w /usr/share/wordlists/dirb/common.txt -m POST

# Resume a scan from a specific wordlist offset
gobuster dir -u http://10.10.10.100 -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt \
  --wordlist-offset 5000

# Force continue even if precheck fails (v3.8+)
gobuster dir -u http://10.10.10.100 -w /usr/share/wordlists/dirb/common.txt --force

# Read wordlist from STDIN (piping)
cat custom_wordlist.txt | gobuster dir -u http://10.10.10.100 -w -

# mTLS client certificate authentication
gobuster dir -u https://10.10.10.100 -w /usr/share/wordlists/dirb/common.txt \
  --client-cert-pem client.pem --client-cert-pem-key client-key.pem

# Save output to file
gobuster dir -u http://10.10.10.100 -w /usr/share/wordlists/dirb/common.txt -o results.txt

2. DNS Subdomain Enumeration (dns)

Discovers subdomains via DNS resolution. Requires the target domain to be resolvable.

All dns Mode Flags

Practical Examples

# Basic subdomain enumeration
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Show resolved IP addresses alongside subdomains
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -i

# Use a custom DNS resolver (bypass internal/split-horizon DNS)
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  -r 1.1.1.1

# Show CNAME records (useful for subdomain takeover identification)
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -c

# Force operation on wildcard domains
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --wildcard

# High thread count for large wordlists
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -t 50

# Disable FQDN trailing dot (skip system search domains for speed)
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt \
  --no-fqdn -t 50

# Save results
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  -i -o subdomains.txt

Tip — DNS enumeration pre-requisite: Ensure the target domain actually resolves. If behind a firewall or using split-horizon DNS, you may need to specify a resolver (-r) that has visibility into the target’s DNS zone.

3. Virtual Host Discovery (vhost)

Sends HTTP requests with different Host: headers to find virtual hosts on a web server. Unlike DNS mode, this does not require DNS resolution — it works directly against the server IP.

All vhost Mode Flags

Practical Examples

# Basic vhost discovery — with --append-domain to build FQDN Host headers
gobuster vhost -u http://10.10.10.100 \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  --domain target.htb --append-domain

# Filter false positives by excluding a known baseline response length
gobuster vhost -u http://10.10.10.100 \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  --domain target.htb --append-domain --exclude-length 301

# Over HTTPS with TLS skip
gobuster vhost -u https://10.10.10.100 \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  --domain target.htb --append-domain -k

# High thread count
gobuster vhost -u http://10.10.10.100 \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt \
  --domain target.htb --append-domain -t 50

Important — VHost vs DNS mode:

• Use DNS mode to discover subdomains via actual DNS resolution.
• Use VHost mode when the server hosts multiple sites on the same IP and you need to discover them by manipulating the Host header.
• VHost is the go-to for HTB/CTF targets where you’ve added the base domain to /etc/hosts and want to find additional virtual hosts.
• From v3.7+, Gobuster warns you if --append-domain might have been forgotten.

4. Fuzz Mode (fuzz)

The most flexible mode. Replaces the keyword FUZZ in the URL, headers, and request body with wordlist entries.

Key fuzz Mode Flags

Fuzz mode shares most HTTP flags with dir mode, plus:

Practical Examples

# Fuzz URL paths
gobuster fuzz -u http://10.10.10.100/FUZZ -w /usr/share/wordlists/dirb/common.txt

# Fuzz API endpoints
gobuster fuzz -u http://10.10.10.100/api/v1/FUZZ \
  -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt

# Fuzz URL parameters (parameter name discovery)
gobuster fuzz -u "http://10.10.10.100/page?FUZZ=test" \
  -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt

# Fuzz parameter values
gobuster fuzz -u "http://10.10.10.100/page?id=FUZZ" \
  -w /usr/share/seclists/Fuzzing/4-digits-0000-9999.txt

# Fuzz the Host header (alternative to vhost mode, more control)
gobuster fuzz -u http://10.10.10.100 \
  -H "Host: FUZZ.target.htb" \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  --exclude-length 1234

# Fuzz POST body data (v3.3+)
gobuster fuzz -u http://10.10.10.100/login \
  -d "username=admin&password=FUZZ" \
  -w /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt

# Fuzz custom headers
gobuster fuzz -u http://10.10.10.100 \
  -H "X-Custom-Header: FUZZ" -w /usr/share/wordlists/dirb/common.txt

# Fuzz with status code and length filtering
gobuster fuzz -u http://10.10.10.100/FUZZ -w /usr/share/wordlists/dirb/common.txt \
  -b 404,403 --exclude-length 0

5. Cloud Storage Enumeration

AWS S3 Buckets

# Basic S3 bucket enumeration
gobuster s3 -w /usr/share/seclists/Discovery/Web-Content/bucket-names.txt

# With debug output
gobuster s3 -w /usr/share/seclists/Discovery/Web-Content/bucket-names.txt --debug

Google Cloud Storage Buckets

# Basic GCS enumeration
gobuster gcs -w /usr/share/seclists/Discovery/Web-Content/bucket-names.txt

# With debug
gobuster gcs -w /usr/share/seclists/Discovery/Web-Content/bucket-names.txt --debug

Note — Both modes check for publicly accessible buckets by name. They don’t confirm read/write access — just existence. Useful during OSINT and external reconnaissance.

6. TFTP Enumeration

gobuster tftp -s 10.10.10.100 -w /usr/share/seclists/Discovery/TFTP/common.txt

Pattern Files

Pattern files multiply each wordlist entry with templated variations. Create a file with {GOBUSTER} as the placeholder:

# patterns.txt
{GOBUSTER}/v1
{GOBUSTER}/v2
{GOBUSTER}/v3

gobuster dir -u http://10.10.10.100 -w /usr/share/wordlists/dirb/common.txt -p patterns.txt

If the wordlist contains api, Gobuster tests /api/v1, /api/v2, /api/v3. Use with caution — this multiplies the total number of requests.

Recommended Wordlists

SecLists (sudo apt install seclists)

Dirb (built-in on Kali)

Dirbuster

Extension Stacking by Tech Stack

When enumerating files, match extensions to the target technology:

# PHP stack
-x php,phps,php5,phtml,phar,inc,bak

# ASP/.NET stack
-x asp,aspx,ashx,asmx,config,dll

# Java stack
-x jsp,jspx,do,action,jsf,faces

# Node/JS stack
-x js,json,ts,mjs

# Python stack
-x py,pyc,wsgi

# General backup/config files (always worth trying)
-x bak,old,orig,save,swp,txt,conf,config,xml,yml,yaml,env,log,sql,db,zip,tar.gz

Advanced Tips & Tricks

Wildcard Handling

If the target returns valid responses for every request (wildcard), Gobuster will detect this and stop. To override:

# Force continue on wildcard (dir mode v3.8+)
gobuster dir -u http://10.10.10.100 -w wordlist.txt --force

# Better approach: filter by the wildcard response size
gobuster dir -u http://10.10.10.100 -w wordlist.txt --exclude-length 4523

Combining with Other Tools

# Generate a custom wordlist from the target using cewl, then feed to gobuster
cewl http://10.10.10.100 -d 2 -m 5 -w custom_wordlist.txt
gobuster dir -u http://10.10.10.100 -w custom_wordlist.txt -x php,html

# Pipe found URLs to httpx for probing
gobuster dir -u http://10.10.10.100 -w wordlist.txt -q --no-error | httpx -silent

# Chain with nuclei for vulnerability scanning on discovered paths
gobuster dir -u http://10.10.10.100 -w wordlist.txt -q -o paths.txt
cat paths.txt | nuclei -t cves/

Rate Limiting & Stealth

# Slow and quiet (2 threads, 1 second delay)
gobuster dir -u http://10.10.10.100 -w wordlist.txt -t 2 --delay 1s

# Random user agent to evade basic fingerprinting
gobuster dir -u http://10.10.10.100 -w wordlist.txt --random-agent

# Custom user agent to blend in
gobuster dir -u http://10.10.10.100 -w wordlist.txt \
  -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"

Recursive Enumeration

Gobuster does not natively support recursion. Chain scans manually:

# Step 1: Initial sweep
gobuster dir -u http://10.10.10.100 -w /usr/share/wordlists/dirb/common.txt -o initial.txt

# Step 2: Drill into discovered directories
gobuster dir -u http://10.10.10.100/admin -w /usr/share/wordlists/dirb/common.txt -o admin_results.txt
gobuster dir -u http://10.10.10.100/uploads -w /usr/share/wordlists/dirb/common.txt -o uploads_results.txt

Tip — If you need native recursion: Use feroxbuster (Rust-based, recursive by default) or dirsearch (Python, built-in recursion).

mTLS / Client Certificates

For targets requiring mutual TLS authentication (v3.3+):

# Using PEM files
gobuster dir -u https://10.10.10.100 -w wordlist.txt \
  --client-cert-pem client.pem \
  --client-cert-pem-key client-key.pem

# Using P12 file (v3.7+ supports SHA256 HMAC P12s from openssl3)
gobuster dir -u https://10.10.10.100 -w wordlist.txt \
  --client-cert-p12 client.p12 \
  --client-cert-p12-password 'P@ssw0rd'

Quick Reference — Common Workflows

HTB / CTF Initial Enumeration

# Step 1: Quick directory sweep
gobuster dir -u http://target.htb -w /usr/share/seclists/Discovery/Web-Content/common.txt \
  -x php,html,txt -t 40 -o initial_scan.txt

# Step 2: VHost discovery (get a baseline response length first, then exclude it)
gobuster vhost -u http://target.htb \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  --domain target.htb --append-domain -t 40 \
  --exclude-length <baseline_length>

# Step 3: Deeper scan on interesting paths
gobuster dir -u http://target.htb/app \
  -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
  -x php -t 40 -o deep_scan.txt

# Step 4: API enumeration if applicable
gobuster dir -u http://target.htb/api \
  -w /usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt \
  -x json -t 40

Web Application Pentest

# Admin panel hunting
gobuster dir -u http://target.com \
  -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt \
  -x php,html -s 200,301,302 -t 30 -o admin_hunt.txt

# Backup and config file discovery
gobuster dir -u http://target.com \
  -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt \
  -x bak,old,conf,config,env,sql,zip,tar.gz,swp -t 30

# Parameter fuzzing
gobuster fuzz -u "http://target.com/page.php?FUZZ=1" \
  -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt \
  -b 404 --exclude-length 0

Bug Bounty Recon

# Subdomain discovery with IP resolution
gobuster dns -d target.com \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt \
  -t 50 -i -o subdomains.txt

# Vhost sweep against discovered infrastructure
gobuster vhost -u http://<target-ip> \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt \
  --domain target.com --append-domain -t 40

# S3 bucket enumeration with company-related names
gobuster s3 -w company_wordlist.txt --debug

Troubleshooting

Version History (Notable Changes)

See Also

Based on Gobuster v3.8.2 — https://github.com/OJ/gobuster