Gobuster
Gobuster is an open-source tool written in Go that is used to brute-force URIs (directories and files) in websites, DNS subdomains, virtual host names on target web servers, and open Amazon S3 buckets. Its speed and efficiency make it a preferred choice among security professionals for reconnaissance and enumeration tasks.
Here are the primary uses of Gobuster:
-
Directory and File Enumeration: Gobuster excels at discovering hidden directories and files on web servers by brute-forcing URIs using wordlists. This capability helps security professionals identify potential entry points and exposed resources that may not be linked from the main website.
-
DNS Subdomain Enumeration: The tool can perform DNS subdomain enumeration to discover subdomains associated with a target domain. This feature is crucial during the reconnaissance phase of penetration testing to map out the complete attack surface of an organization.
-
Virtual Host Discovery: Gobuster can enumerate virtual hosts on a web server, revealing multiple websites hosted on the same IP address. This functionality helps identify all web applications associated with a target infrastructure.
-
S3 Bucket Enumeration: It includes functionality to enumerate Amazon S3 buckets, helping identify publicly accessible cloud storage that may contain sensitive information or misconfigurations that could be exploited.
-
High Performance: Written in Go and utilizing goroutines, Gobuster provides exceptional speed and efficiency. It can handle multiple concurrent requests, making it significantly faster than many alternative tools for similar tasks.
-
Flexibility and Customization: Gobuster offers various modes and options that allow users to customize their scans according to specific requirements, including custom headers, authentication, proxy support, and pattern matching.
Core Features
- High-Speed Scanning
- Multiple Enumeration Modes
- Directory and File Brute-forcing
- DNS Subdomain Enumeration
- Virtual Host Discovery
- S3 Bucket Enumeration
- Wildcard Detection
- Custom Wordlist Support
- Pattern Matching and Filtering
- Proxy and Authentication Support
- Recursive Scanning
- Custom HTTP Headers
Data sources
- Wordlists
- Target URLs
- DNS Resolvers
- HTTP Response Codes
- Response Content
- DNS Records
- Virtual Host Configurations
- S3 Bucket Names
Common Gobuster Commands
1. Directory Enumeration (Basic)
- This command performs basic directory enumeration on the target URL using the specified wordlist. It discovers hidden directories and files on the web server.
gobuster dir -u http://example.com -w /path/to/wordlist.txt
2. Specify File Extensions
- This command searches for files with specific extensions during directory enumeration. It helps identify specific file types like PHP, HTML, or configuration files on the target server.
gobuster dir -u http://example.com -w /path/to/wordlist.txt -x php,html,txt
3. DNS Subdomain Enumeration
- This command discovers subdomains of the target domain using DNS enumeration. It helps map the complete subdomain structure of an organization's online presence.
gobuster dns -d example.com -w /path/to/subdomains.txt
4. Virtual Host Discovery
- This command enumerates virtual hosts on a target server. It reveals multiple websites or applications hosted on the same IP address or server infrastructure.
gobuster vhost -u http://example.com -w /path/to/vhosts.txt
5. S3 Bucket Enumeration
- This command searches for publicly accessible Amazon S3 buckets using the provided wordlist. It helps identify potential data exposure through misconfigured cloud storage.
gobuster s3 -w /path/to/bucket-names.txt
6. Custom Status Codes
- This command filters results to display only responses with specific HTTP status codes. It allows users to focus on particular response types during enumeration.
gobuster dir -u http://example.com -w /path/to/wordlist.txt -s 200,204,301,302,307,401
7. Add Custom Headers
- This command adds custom HTTP headers to requests. It's useful for bypassing certain security controls or providing authentication tokens during enumeration.
gobuster dir -u http://example.com -w /path/to/wordlist.txt -H "Authorization: Bearer token"
8. Use Proxy
- This command routes all requests through a specified proxy server. It's essential for traffic analysis, authentication, or bypassing network restrictions.
gobuster dir -u http://example.com -w /path/to/wordlist.txt --proxy http://127.0.0.1:8080
9. Recursive Enumeration
- This command enables recursive scanning, automatically enumerating subdirectories found during the initial scan. It provides comprehensive directory structure mapping.
gobuster dir -u http://example.com -w /path/to/wordlist.txt -r
10. Timeout and Threads Configuration
- This command sets custom timeout values and thread count for the scan. It allows optimization of scan speed while avoiding server overload or detection.
gobuster dir -u http://example.com -w /path/to/wordlist.txt -t 50 --timeout 10s
11. Exclude Response Length
- This command excludes results based on response length, filtering out false positives or uninteresting results based on content size.
gobuster dir -u http://example.com -w /path/to/wordlist.txt --exclude-length 1234
12. Output to File
- This command saves the scan results to a specified output file. It facilitates post-scan analysis and integration with other security tools.
gobuster dir -u http://example.com -w /path/to/wordlist.txt -o results.txt
13. Help and Usage Information
- This command displays the help menu and usage information for Gobuster, listing all available options and modes.
gobuster -h
Alternative usage:
gobuster --help
Output Examples of Gobuster Commands
| Command | Example Usage | Function | Output Example |
|---|---|---|---|
| Directory Enumeration | gobuster dir -u http://example.com -w wordlist.txt | Performs basic directory enumeration. | http://example.com/admin (Status: 200) [Size: 1234] |
| Specify File Extensions | gobuster dir -u http://example.com -w wordlist.txt -x php,html | Searches for files with specific extensions. | http://example.com/index.php (Status: 200) |
| Custom Status Codes | gobuster dir -u http://example.com -w wordlist.txt -s 200,301 | Filters results by HTTP status codes. | http://example.com/backup (Status: 301) |
| DNS Subdomain Enumeration | gobuster dns -d example.com -w subdomains.txt | Discovers subdomains via DNS enumeration. | Found: admin.example.com |
| Virtual Host Discovery | gobuster vhost -u http://example.com -w vhosts.txt | Enumerates virtual hosts on the server. | Found: dev.example.com (Status: 200) |
| S3 Bucket Enumeration | gobuster s3 -w bucket-names.txt | Searches for accessible S3 buckets. | http://example-bucket.s3.amazonaws.com (Status: 200) |
| Add Custom Headers | gobuster dir -u http://example.com -w wordlist.txt -H "X-Custom: value" | Adds custom HTTP headers to requests. | Using custom header: X-Custom |
| Use Proxy | gobuster dir -u http://example.com -w wordlist.txt --proxy http://127.0.0.1:8080 | Routes requests through a proxy. | Using proxy: http://127.0.0.1:8080 |
| Recursive Scanning | gobuster dir -u http://example.com -w wordlist.txt -r | Enables recursive directory scanning. | http://example.com/admin/users (Status: 200) |
| Wildcard Detection | gobuster dir -u http://example.com -w wordlist.txt --wildcard | Detects and handles wildcard responses. | Wildcard response detected: disabling wildcards |
| Follow Redirects | gobuster dir -u http://example.com -w wordlist.txt -r | Follows HTTP redirects automatically. | http://example.com/old → http://example.com/new |
| Set Threads | gobuster dir -u http://example.com -w wordlist.txt -t 50 | Sets the number of concurrent threads. | Using 50 threads |
| Set Timeout | gobuster dir -u http://example.com -w wordlist.txt --timeout 10s | Sets request timeout duration. | Timeout set to 10 seconds |
| Exclude Length | gobuster dir -u http://example.com -w wordlist.txt --exclude-length 1234 | Excludes responses with specific length. | Excluding responses of length 1234 |
| Pattern Matching | gobuster dir -u http://example.com -w wordlist.txt -p pattern.txt | Uses pattern file for enumeration. | Using pattern file: pattern.txt |
| No Status Codes | gobuster dir -u http://example.com -w wordlist.txt -n | Disables status code display. | http://example.com/admin |
| No Progress Bar | gobuster dir -u http://example.com -w wordlist.txt -q | Disables progress bar output. | http://example.com/admin (Status: 200) |
| Verbose Output | gobuster dir -u http://example.com -w wordlist.txt -v | Enables verbose output mode. | [+] Mode: dir [+] Url: http://example.com |
| Output to File | gobuster dir -u http://example.com -w wordlist.txt -o output.txt | Saves results to a file. | Results saved to output.txt |
| Username Enumeration | gobuster dir -u http://example.com -w wordlist.txt -U username -P password | Provides credentials for authentication. | Using basic authentication: username |
| User-Agent String | gobuster dir -u http://example.com -w wordlist.txt -a "Mozilla/5.0" | Sets custom User-Agent header. | Using User-Agent: Mozilla/5.0 |
| Cookies | gobuster dir -u http://example.com -w wordlist.txt -c "session=abc123" | Adds cookies to requests. | Using cookies: session=abc123 |
| No TLS Verification | gobuster dir -u https://example.com -w wordlist.txt -k | Skips TLS certificate verification. | Skipping TLS verification |
| DNS Resolver | gobuster dns -d example.com -w wordlist.txt -r 8.8.8.8 | Uses custom DNS resolver. | Using DNS resolver: 8.8.8.8 |
| Show IPs | gobuster dns -d example.com -w wordlist.txt -i | Displays IP addresses in DNS mode. | admin.example.com [192.168.1.1] |
| Show CNAMEs | gobuster dns -d example.com -w wordlist.txt --show-cname | Displays CNAME records in DNS mode. | www.example.com → cdn.example.com |