Gobuster

Directory, DNS subdomain & vhost brute-forcing

Gobuster Cheat Sheet

Gobuster is a fast Go brute-forcer for directories/files, DNS subdomains, virtual hosts, S3 buckets, and more — driven by per-mode subcommands (dir, dns, vhost, fuzz, s3). For authorized testing only.

1. Basic usage

gobuster <mode> [flags]
gobuster dir  -u https://target -w /usr/share/wordlists/dirb/common.txt
gobuster dns  -d target.com     -w subdomains.txt
gobuster vhost -u https://target.com -w subdomains.txt --append-domain

Modes: dir, dns, vhost, fuzz, s3, gcs, tftp, version.

2. Global flags (most modes)

Flag	Purpose
-w	Wordlist path
-t	Threads (default 10)
-o	Write output to a file
-q	Quiet (suppress banner/progress)
-v	Verbose
-z	No progress bar
--delay	Delay between requests, e.g. 100ms
--wordlist-offset	Resume from an index

3. dir — directory & file brute force

gobuster dir -u https://target -w wordlist.txt
gobuster dir -u https://target -w wordlist.txt -x php,html,txt   # extensions
gobuster dir -u https://target -w wordlist.txt -r               # follow redirects
gobuster dir -u https://target -w wordlist.txt -k               # skip TLS cert check
gobuster dir -u https://target -w wordlist.txt -e               # print full URLs

dir flags

Flag	Purpose
-x	Extensions: php,html,bak
-s	Status codes to show (whitelist)
-b	Status codes to hide (blacklist)
-r	Follow redirects
-k	Ignore TLS certificate errors
-c	Cookies: "SESSION=abc"
-H	Custom header (repeatable)
-a / --useragent	Set User-Agent
-P / -U	HTTP basic auth password / username
-n	No-status (don't print status codes)
--exclude-length	Hide responses of a given length

# Hide noisy codes, add auth + a custom header
gobuster dir -u https://target -w big.txt -x php,txt \
  -b 404,403 -c "PHPSESSID=abc" -H "X-Forwarded-For: 127.0.0.1" -k

4. dns — subdomain enumeration

gobuster dns -d target.com -w subdomains.txt
gobuster dns -d target.com -w subdomains.txt -i            # show resolved IPs
gobuster dns -d target.com -w subdomains.txt -r 1.1.1.1    # custom resolver
gobuster dns -d target.com -w subdomains.txt -c            # show CNAME records

Flag	Purpose
-d	Target domain
-i	Show IP addresses
-c	Show CNAME records
-r	Use a specific DNS resolver
--wildcard	Force continue on wildcard DNS

5. vhost — virtual-host discovery

gobuster vhost -u https://target.com -w subdomains.txt --append-domain
gobuster vhost -u http://10.10.10.10 -w vhosts.txt --append-domain -k
gobuster vhost -u https://target.com -w subdomains.txt --exclude-length 1234

• --append-domain appends the base domain to each word (word → word.target.com). Required in current versions to build real FQDNs.
• Filter false positives with --exclude-length.

6. fuzz — generic FUZZ keyword

# Put FUZZ anywhere in URL, header, or body
gobuster fuzz -u https://target/FUZZ -w wordlist.txt
gobuster fuzz -u "https://target/?param=FUZZ" -w values.txt -b 404
gobuster fuzz -u https://target -H "X-Header: FUZZ" -w list.txt

-b/--exclude-statuscodes and --exclude-length are the main noise filters here.

7. s3 / gcs — cloud bucket discovery

gobuster s3  -w bucket-names.txt
gobuster gcs -w bucket-names.txt
gobuster s3  -w bucket-names.txt -m 60          # max errors before quitting

8. Output

gobuster dir -u https://target -w list.txt -o results.txt
gobuster dir -u https://target -w list.txt -q -o results.txt   # clean file output

9. Real-world examples

# Web content discovery with extensions, hide 404s, ignore bad TLS
gobuster dir -u https://target -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
  -x php,txt,html -b 404 -k -t 50 -o dirs.txt

# Subdomains with IPs against a chosen resolver
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -i -r 8.8.8.8

# Vhosts on an IP, filtering a fixed-size default page
gobuster vhost -u http://10.10.10.10 -w vhosts.txt --append-domain --exclude-length 0 -k

10. Tips

• gobuster does not recurse — run it again on interesting directories, or use ffuf's -recursion for that.
• Use -b 404 (or -s 200,204,301,302,401,403) to cut the noise; add --exclude-length for catch-all pages of constant size.
• Add -k for self-signed HTTPS labs and -t 50 to speed up (back off if you hit rate limits).
• SecLists wordlists live under /usr/share/seclists/Discovery/.
• Remember --append-domain for both dns (implicit) and especially vhost.

Authorized testing only. Practice on the AYSEC challenges. Related: ffuf (Web Fuzzing)