Gobuster Commands — Upd ~upd~

Gobuster is a high-performance, multi-threaded tool written in Go, primarily used for discovering hidden content on web servers and cloud infrastructure through brute-forcing. Its utility spans several specialized modes—from traditional directory discovery to modern cloud bucket enumeration—making it a staple in penetration testing and security auditing. Core Operational Modes

As of 2026, Gobuster supports several distinct modes of operation, each tailored to a specific reconnaissance task: gobuster | Kali Linux Tools

gobuster dir -u https://example.com -w wordlist.txt -x php,txt -t Use code with caution. Copied to clipboard 🌐 DNS Mode ( Used for subdomain enumeration. Target domain gobuster dns -d example.com Subdomain wordlist -w subdomains.txt Show IP addresses Use custom DNS resolver -r 8.8.8.8 Show CNAME records --wildcard Force scan even if wildcard DNS is found --wildcard Example Command:

gobuster dns -d example.com -w /path/to/subdomains.txt -i -t Use code with caution. Copied to clipboard 🖥️ VHost Mode ( Identifies virtual hosts by changing the gobuster vhost -u -w --append-domain appends the base domain to each wordlist entry. --exclude-length filters out false positives by response size. Example Command: gobuster vhost -u

Mode 4: Fuzzing Mode (Powerful & Flexible)

The fuzz mode replaces the older dir mode’s limitations:

gobuster fuzz -u https://example.com/FUZZ/admin -w words.txt

You can use multiple FUZZ placeholders:

gobuster fuzz -u https://example.com/FUZZ/api/v1/user?name=FUZZ2 -w words.txt -w users.txt

7. Comparison with Alternatives

| Tool | Best for | |------|-----------| | Gobuster | Simple, fast directory/dns brute-force | | ffuf | Advanced fuzzing, recursion, multi-parameter | | Dirb | Legacy, less features | | Dirbuster | GUI, recursive scanning | | wfuzz | Parameter fuzzing, payload processing |

Verdict: Gobuster is excellent for quick directory enumeration and subdomain discovery but lacks recursion and advanced fuzzing features found in ffuf.

3. VHost Brute-Forcing

Gobuster can be used to brute-force virtual hosts (vHosts) on a web server. The following command is used for vHost brute-forcing:

gobuster vhost -u <target_url> -w <wordlist>
  • -u: Specifies the target URL.
  • -w: Specifies the wordlist to use for brute-forcing.

Example:

gobuster vhost -u http://example.com -w /usr/share/wordlists/vhosts.txt

This command will brute-force vHosts on the target URL http://example.com using the wordlist vhosts.txt. gobuster commands upd

a) Directory/File Brute-Forcing (dir)

Basic command:

gobuster dir -u http://example.com -w /usr/share/wordlists/dirb/common.txt

Essential flags: | Flag | Description | |------|-------------| | -t 50 | Threads (default 10, increase for speed) | | -x php,txt,html | Append file extensions | | -s "200,204,301,302" | Show only specific status codes | | -b "404,403" | Hide specific status codes | | -k | Skip SSL certificate verification | | -r | Follow redirects | | -o output.txt | Save results to file | | -q | Quiet mode (no banner/progress) | | --status-codes-blacklist | Blacklist status codes | | --wildcard | Handle wildcard DNS responses |

Advanced example:

gobuster dir -u https://target.com -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-directories.txt -t 100 -x php,asp,aspx,jsp,html,txt -s 200,204,301,302 -k -r -o dir_results.txt

Commands and Options

Here are some key commands and options you might find useful:

  • -h or --help: Displays help information about Gobuster and its usage. You can use multiple FUZZ placeholders: gobuster fuzz

    gobuster -h

  • -u or --url: Specifies the target URL to scan. This option is crucial and must be followed by the URL you wish to test.

    gobuster -u https://example.com

  • -w or --wordlist: This option specifies the wordlist to use for the brute-force attack. Wordlists are essential for dictionary attacks.

    gobuster -u https://example.com -w /path/to/wordlist.txt

  • -o or --output: Allows you to save the results to a file.

    gobuster -u https://example.com -w /path/to/wordlist.txt -o output.txt

  • -b or --blacklist: Enables you to blacklist certain extensions or status codes.

    gobuster -u https://example.com -w /path/to/wordlist.txt --blacklist-statuscodes 404

Pro Tips for Efficiency

  1. Don't use common.txt: It is too small for real-world assessments. Move to SecLists (raft-medium-directories.txt or directory-list-2.3-medium.txt).
    • Install SecLists: sudo apt install seclists
  2. Mind the WAF: If you set threads too high (-t 100), you might trigger a Web Application Firewall or get your IP banned. Start with -t 20 and increase slowly.
  3. Use the wildcard trick: If a site returns 200 OK for every directory (a wildcard response), check the content length. Use -b to exclude the size of the generic "404" page.
  4. Recursive Scanning: Gobuster does not support recursion natively (scanning inside found folders). If you need recursion, use a tool like feroxbuster or run Gobuster manually on found directories: 
    gobuster dir -u http://target.com/found-dir/ -w wordlist.txt

7. How to Check Your Version & Update

gobuster version          # Show current version
# Install latest:
go install github.com/OJ/gobuster/v3@latest
# Or via package manager:
sudo apt update && sudo apt install gobuster   # Debian/Ubuntu

Part 5: Real-World Command Examples (UPD Use Cases)