security enabled verified medium v1.0.0

gobuster

Multi-purpose brute-force tool for directory/file discovery, DNS subdomain enumeration, and cloud bucket enumeration.

📋 Live Preview

gobuster dir -u {target} -w {wordlist} -t {threads}

🌍 target → url 🌍 wordlist → /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt 🌍 threads → 10

gobuster dir -u {target} -w {wordlist} -t {threads}

Sandbox: execFile · Timeout: 1800s

Capabilities

web.discovery.path

web.discovery.file

web.discovery.vhost

web.discovery.dns

web.discovery.bucket

web.content.brute

Parameters

Name	Type	Required	Default	Description	Aliases
`mode`	string	Yes	-	Mode: dir, dns, vhost, s3
`url`	string	No	-	Target URL (dir, vhost modes)	`-u`
`domain`	string	No	-	Target domain (dns mode)	`-d`
`wordlist`	file	Yes	-	Path to wordlist file	`-w`
`threads`	integer	No	10	Number of concurrent threads	`-t`
`extensions`	string	No	-	File extensions to search (dir mode)	`-x`
`output`	file	No	-	Output file path	`-o`
`status-codes`	string	No	-	Status codes to include (positive)	`-s`
`insecure`	boolean	No	-	Skip TLS certificate verification	`-k`
`no-redirect`	boolean	No	-	Do not follow redirects	`-n`
`cookies`	string	No	-	Cookies to include in requests	`-c`
`headers`	string	No	-	Custom HTTP headers	`-H`
`timeout`	integer	No	-	HTTP request timeout in seconds	`--timeout`
`wildcard`	boolean	No	-	Force wildcard detection	`--wildcard`
`exclude-length`	integer	No	-	Exclude results of given content length	`--exclude-length`
`quiet`	boolean	No	-	Quiet mode (no banner or progress)	`-q`
`follow-redirect`	boolean	No	-	Follow HTTP redirects	`-r`
`exclude_length`	boolean	No	-	Exclude results of given content length	`--exclude-length`
`r`	boolean	No	-	Follow HTTP redirects	`-r`, `--follow-redirect`
`z`	boolean	No	-	Do not display progress	`-z`, `--no-progress`

Artifacts

Type	Description	MIME	Schema	Trust
`web.discovery.results`	Discovered paths or subdomains	application/json	-	verified
`web.discovery.dns`	DNS subdomain enumeration results	text/plain	-	verified

Contract

Inputs

web.target.url

Target URL

network.target.domain

Target domain for DNS enumeration

file.wordlist

Wordlist for brute-forcing

Outputs

web.discovery.results

Discovered paths or subdomains

Side effects: network_trafficnetwork_traffic

Workflow Edges

Produces

web.discovery.results

Consumes

web.target.urlnetwork.target.domainfile.wordlist

Resource Profile

Resource	Value
CPU	low
Memory	64 MB
Network	medium
Disk I/O	low

Examples

Directory brute-force with common wordlist

gobuster dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt -t 50

Directory scan with file extensions

gobuster dir -u https://example.com -w wordlist.txt -x php,html,asp -t 30

DNS subdomain enumeration

gobuster dns -d example.com -w /usr/share/wordlists/amass/subdomains-top1mil-5000.txt -t 20

Virtual host enumeration

gobuster vhost -u https://example.com -w vhost-wordlist.txt -t 20

S3 bucket enumeration

gobuster s3 -w bucket-names.txt

Scan with custom headers and cookies

gobuster dir -u https://example.com -w wordlist.txt -H "Authorization: Bearer token" -c "session=abc123"

Quiet mode with status code filtering

gobuster dir -u https://example.com -w wordlist.txt -s 200,204,301,302,307 -q

Documentation

Gobuster — Multi-Purpose Brute-Force Tool

Gobuster is a fast, multi-purpose brute-force tool written in Go. It supports directory/file discovery, DNS subdomain enumeration, virtual host discovery, and cloud bucket enumeration.

Modes

Mode	Command	Description
Directory	`gobuster dir -u URL -w WORDLIST`	Find hidden directories/files
DNS	`gobuster dns -d DOMAIN -w WORDLIST`	Enumerate DNS subdomains
VHost	`gobuster vhost -u URL -w WORDLIST`	Discover virtual hosts
S3	`gobuster s3 -w WORDLIST`	Find S3 buckets

Basic Usage

# Directory brute-force
gobuster dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt -t 50

# DNS subdomain enumeration
gobuster dns -d example.com -w subdomains.txt -t 20

# Virtual host discovery
gobuster vhost -u https://example.com -w vhosts.txt -t 30

Operational Security

High thread counts can overwhelm target servers
Use -k to skip TLS verification on internal networks
DNS queries can be logged by the DNS server
Scanning without authorization is illegal

Related Tools

dirsearchferoxbusterffufwfuzz

References

Gobuster GitHub