> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/web-discovery/gobuster.md). # Gobuster Gobuster is a tool used to brute-force: * URIs (directories and files) in web sites, * DNS subdomains (with wildcard support), * Virtual Host names on target web servers, * Open Amazon S3 buckets, * Open Google Cloud buckets and * TFTP servers. Gobuster is useful for pentesters, ethical hackers and forensics experts. It also can be used for security tests. ## Directory/file enumeration mode Scan for directories and files with specific extensions (`-x`) and follow redirects (`-r`). By default gobuster uses 10 threads and might be a bit slow. It is recommended to increase the number of threads to 32 with `-t 32`. ```bash gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -r -t 32 -x php,txt,html -u http://10.11.12.13/ ``` Scan for directories and files with specific extensions (`-x`), follow redirects (`-r`), and only include certain status codes (`-s`). Use when seeing the error message: `Error: the server returns a status code that matches the provided options for non existing urls.` ```bash gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -r -t 32 -x php,txt,html -s "204,301,302,307,401,403" -u http://10.10.143.49/ ``` Types of files that might be interesting to scan for: * HTML-files (htm, html) * Scripts (aspx, php, js) * Configuration files (conf, config) * Backup files (bak) * Text files (txt) ## Virtual host name enumeration mode Scan for virtual hosts on a web site ```bash gobuster vhost -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://webenum.thm ``` ## Usage information
gobuster -h ``` ┌──(kali㉿kali)-[~/Desktop] └─$ gobuster -h Usage: gobuster [command] Available Commands: completion Generate the autocompletion script for the specified shell dir Uses directory/file enumeration mode dns Uses DNS subdomain enumeration mode fuzz Uses fuzzing mode. Replaces the keyword FUZZ in the URL, Headers and the request body gcs Uses gcs bucket enumeration mode help Help about any command s3 Uses aws bucket enumeration mode tftp Uses TFTP enumeration mode version shows the current version vhost Uses VHOST enumeration mode (you most probably want to use the IP address as the URL parameter) Flags: --debug Enable debug output --delay duration Time each thread waits between requests (e.g. 1500ms) -h, --help help for gobuster --no-color Disable color output --no-error Don't display errors -z, --no-progress Don't display progress -o, --output string Output file to write results to (defaults to stdout) -p, --pattern string File containing replacement patterns -q, --quiet Don't print the banner and other noise -t, --threads int Number of concurrent threads (default 10) -v, --verbose Verbose output (errors) -w, --wordlist string Path to the wordlist. Set to - to use STDIN. --wordlist-offset int Resume from a given position in the wordlist (defaults to 0) Use "gobuster [command] --help" for more information about a command. ```
gobuster dir -h ``` ┌──(kali㉿kali)-[~/Desktop] └─$ gobuster dir -h Uses directory/file enumeration mode Usage: gobuster dir [flags] Flags: -f, --add-slash Append / to each request --client-cert-p12 string a p12 file to use for options TLS client certificates --client-cert-p12-password string the password to the p12 file --client-cert-pem string public key in PEM format for optional TLS client certificates --client-cert-pem-key string private key in PEM format for optional TLS client certificates (this key needs to have no password) -c, --cookies string Cookies to use for the requests -d, --discover-backup Also search for backup files by appending multiple backup extensions --exclude-length string exclude the following content lengths (completely ignores the status). You can separate multiple lengths by comma and it also supports ranges like 203-206 -e, --expanded Expanded mode, print full URLs -x, --extensions string File extension(s) to search for -X, --extensions-file string Read file extension(s) to search from the file -r, --follow-redirect Follow redirects -H, --headers stringArray Specify HTTP headers, -H 'Header1: val1' -H 'Header2: val2' -h, --help help for dir --hide-length Hide the length of the body in the output -m, --method string Use the following HTTP method (default "GET") --no-canonicalize-headers Do not canonicalize HTTP header names. If set header names are sent as is. -n, --no-status Don't print status codes -k, --no-tls-validation Skip TLS certificate verification -P, --password string Password for Basic Auth --proxy string Proxy to use for requests [http(s)://host:port] or [socks5://host:port] --random-agent Use a random User-Agent string --retry Should retry on request timeout --retry-attempts int Times to retry on request timeout (default 3) -s, --status-codes string Positive status codes (will be overwritten with status-codes-blacklist if set). Can also handle ranges like 200,300-400,404. -b, --status-codes-blacklist string Negative status codes (will override status-codes if set). Can also handle ranges like 200,300-400,404. (default "404") --timeout duration HTTP Timeout (default 10s) -u, --url string The target URL -a, --useragent string Set the User-Agent string (default "gobuster/3.6") -U, --username string Username for Basic Auth Global Flags: --debug Enable debug output --delay duration Time each thread waits between requests (e.g. 1500ms) --no-color Disable color output --no-error Don't display errors -z, --no-progress Don't display progress -o, --output string Output file to write results to (defaults to stdout) -p, --pattern string File containing replacement patterns -q, --quiet Don't print the banner and other noise -t, --threads int Number of concurrent threads (default 10) -v, --verbose Verbose output (errors) -w, --wordlist string Path to the wordlist. Set to - to use STDIN. --wordlist-offset int Resume from a given position in the wordlist (defaults to 0) ```
gobuster vhost -h ```bash ┌──(kali㉿kali)-[~] └─$ gobuster vhost -h Uses VHOST enumeration mode (you most probably want to use the IP address as the URL parameter) Usage: gobuster vhost [flags] Flags: --append-domain Append main domain from URL to words from wordlist. Otherwise the fully qualified domains need to be specified in the wordlist. --client-cert-p12 string a p12 file to use for options TLS client certificates --client-cert-p12-password string the password to the p12 file --client-cert-pem string public key in PEM format for optional TLS client certificates --client-cert-pem-key string private key in PEM format for optional TLS client certificates (this key needs to have no password) -c, --cookies string Cookies to use for the requests --domain string the domain to append when using an IP address as URL. If left empty and you specify a domain based URL the hostname from the URL is extracted --exclude-length string exclude the following content lengths (completely ignores the status). You can separate multiple lengths by comma and it also supports ranges like 203-206 -r, --follow-redirect Follow redirects -H, --headers stringArray Specify HTTP headers, -H 'Header1: val1' -H 'Header2: val2' -h, --help help for vhost -m, --method string Use the following HTTP method (default "GET") --no-canonicalize-headers Do not canonicalize HTTP header names. If set header names are sent as is. -k, --no-tls-validation Skip TLS certificate verification -P, --password string Password for Basic Auth --proxy string Proxy to use for requests [http(s)://host:port] or [socks5://host:port] --random-agent Use a random User-Agent string --retry Should retry on request timeout --retry-attempts int Times to retry on request timeout (default 3) --timeout duration HTTP Timeout (default 10s) -u, --url string The target URL -a, --useragent string Set the User-Agent string (default "gobuster/3.6") -U, --username string Username for Basic Auth Global Flags: --debug Enable debug output --delay duration Time each thread waits between requests (e.g. 1500ms) --no-color Disable color output --no-error Don't display errors -z, --no-progress Don't display progress -o, --output string Output file to write results to (defaults to stdout) -p, --pattern string File containing replacement patterns -q, --quiet Don't print the banner and other noise -t, --threads int Number of concurrent threads (default 10) -v, --verbose Verbose output (errors) -w, --wordlist string Path to the wordlist. Set to - to use STDIN. --wordlist-offset int Resume from a given position in the wordlist (defaults to 0) ```
## Resources Gobuster - Github: Gobuster - Kali Tools: Gobuster - README: Gobuster - Tutorial: