GoBuster

What is Gobuster?

Gobuster is a fast, command-line brute-forcing tool written in Go, designed to discover hidden content during a web assessment. Given a wordlist, it tries paths, subdomains or Host headers and tells you which ones exist based on the server's response. Its speed (thanks to Go's concurrency) and simplicity have made it a favourite for the enumeration phase.

Gobuster works in modes. The three most used are dir (directories and files), dns (subdomains) and vhost (virtual hosts via the Host header).

What Gobuster is used for

• Enumerating unlinked directories and files: admin panels, backups, config files, API endpoints.
• Discovering subdomains of a domain within the assessment scope.
• Finding virtual hosts that answer on the same IP but with a different Host header.
• Expanding the attack surface in web pentesting and CTF challenges.

Only use it against your own sites, labs, challenges or systems with written authorisation. Aggressive enumeration generates a lot of traffic and gets logged.

How to install Gobuster

On Kali Linux and Parrot OS it is in the repositories:

sudo apt update
sudo apt install gobuster

If you have Go installed, you can grab the latest version directly:

go install github.com/OJ/gobuster/v3@latest

Check it works and read the help for each mode:

gobuster --help
gobuster dir --help

How to use Gobuster: practical examples

dir mode: directories and files

The most common use. You give the URL with -u and the wordlist with -w:

gobuster dir -u http://192.168.56.101 -w /usr/share/wordlists/dirb/common.txt

To also look for files with specific extensions, use -x:

gobuster dir -u http://192.168.56.101 \
  -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -x php,txt,html,bak

Useful options: -t sets the threads (10 by default), -k ignores TLS certificate errors, -r follows redirects and -o saves the output:

gobuster dir -u https://192.168.56.101 -w common.txt -t 30 -k -o dir.txt

By default Gobuster treats certain status codes as "found". You can control this with a blacklist -b (e.g. -b 404,403) or a status whitelist with -s.

dns mode: subdomains

Here you give the domain with -d and a wordlist of subdomain names:

gobuster dns -d target.local -w /usr/share/wordlists/subdomains.txt

With -i it also shows the resolved IPs of each subdomain found.

vhost mode: virtual hosts

It tries different Host headers against the same IP to uncover sites that only answer to a specific name:

gobuster vhost -u http://192.168.56.101 -w /usr/share/wordlists/subdomains.txt --append-domain

In recent Gobuster versions you need --append-domain so it joins the wordlist entries with the base domain; check gobuster vhost --help for your version.

Pro tips

• The wordlist is everything. SecLists (/usr/share/seclists/) offers excellent lists for every case; start small and expand if needed.
• Try several extensions based on the detected technology (php, asp, aspx, jsp) so you do not miss interesting files.
• Watch the status codes. A 403 often means the resource exists but is protected: that is valuable information too.
• Do not overdo the threads. Too much concurrency can knock over a lab server or trip protections; ramp up gradually.
• Pair it with Burp Suite to investigate each interesting path you find by hand.

Pros and cons

Pros	Cons
Very fast thanks to Go	No native recursion across all modes
dir, dns and vhost modes in one tool	Fewer filtering options than ffuf
Simple and lightweight, no dependencies	Entirely dependent on wordlist quality

Gobuster alternatives

• ffuf: a very flexible Go fuzzer with advanced filters by code, size and words.
• feroxbuster: written in Rust, with very handy automatic recursion.
• dirb and dirbuster: slower but simple classics.
• To practise web enumeration, machines on Hack The Box and TryHackMe.

Frequently asked questions

Is Gobuster free?

Yes, it is a free, open-source project available on GitHub and in the Kali and Parrot repositories.

What is the difference between Gobuster and ffuf?

Both brute-force web content. Gobuster is very direct and organised into modes; ffuf is more flexible, with advanced filters (-fc, -fs, -mc) and fuzzing of any part of the request.

Where do I get good wordlists?

The SecLists package is the standard; on Kali it is usually at /usr/share/seclists/. You also have the dirb and dirbuster lists preinstalled.

Why do I get so many false positives?

Some servers answer 200 to any path (wildcard pages). Use status blacklists or compare response sizes to discard them.

Want to learn web enumeration methodology step by step? You will find it at the Hackers en Acción Academy.