Skip to content

Gobuster

Directory, DNS and vhost brute forcer

VerifiedPentesting· Content DiscoveryBeginnerOpen sourceEntry revised 13 Jan 2026
  • Linux
  • macOS
  • Windows
  • Kali
  • Parrot
  • Arch
  • Docker
  • Source
Official siteSource

Overview

5 commands documented

Gobuster drives lists at a target through purpose-built modes: `dir` for paths, `vhost` for Host headers, `dns` for subdomains, `fuzz` for templated positions, `smb` for shares. It is deliberately simple to run and easy to script.

It reports what a server answered; interpreting that answer — a redirect chain, a 403 that is actually a WAF, a 200 of size zero — is the work of the analyst.

Supported platforms

8

Documented install or usage guidance

Learning curve

beginner

Difficulty of becoming productive, not of the underlying theory

Tags

content discovery, directories, dns, vhost, wordlist

Dataset entry

gobuster.ts

Reviewed 2026-01-13

Installation

Grouped by platform. Elevation requirements are marked per method.

Chocolatey

Recommendedchoco

Needs elevated privileges (sudo / Administrator).

choco install gobuster

Package availability follows your distribution and enabled repositories. Entry revised 13 Jan 2026 — confirm the current release on the project's own download page.

Commands

5 entries

Every command carries its purpose, an example where useful, and the limitations that change how you should read the output.

01Directory discovery

bash

Requests each word as a path and prints the ones that are not suppressed by status.

gobuster dir -u http://192.0.2.20 -w /usr/share/wordlists/dirb/common.txt -t 20
  • Authorized targets only; 20 threads against a small application is enough to degrade it.

Notes

  • `-x php,html,txt` appends extensions, `-k` skips TLS verification, `-o out.txt` saves output.

02Control what counts as interesting

bash

Explicit status handling is the difference between 40 lines and 4,000.

gobuster dir -u https://app.internal -w wordlist.txt -s 301,302 --status-code-list 200,401,403

Notes

  • `-b/--suppress-word-list`-style suppression is a v3 feature; check `gobuster dir -h` for the flags your release supports.

03Subdomain enumeration

bash

Resolves each word as a name and keeps the ones that answer.

gobuster dns -d example.internal -w subdomains-top1million-5000.txt -i

Notes

  • `-i` prints resolved IPs. DNS results are only as good as the resolver you trust — add `--resolver 1.1.1.1` when your local resolver lies.

04Virtual host discovery

bash

Sends each word in the Host header to one IP.

gobuster vhost -u http://192.0.2.20 -w hosts.txt -s 404

05Fuzz a templated position

bash

v3's generic mode: FUZZ can sit in the path, query, header or cookie.

gobuster fuzz -u 'https://app.internal/asset/{{FILE}}' -w files.txt -H 'X-Debug: {{DEBUG}}'

Notes

  • Two lists multiply the request count. Compute it before running.

What it is used for

  • Exposure review of an internal app

    Enumerate paths and hosts within an agreed window.

  • Attack-surface baseline

    Record subdomains per environment for continuous comparison.

Common errors

Symptoms you will actually hit, with the cause and the legitimate fix.

Everything returns 200Cause 1/2

Possible causes

  • Catch-all routing or a front controller responding to unknown paths.

Usual fix

Compare against a deliberately random path (`-u .../gobuster-baseline-xyz`) and suppress that size with `--status-code`/filtering; or switch to ffuf with `-fs`/`-recalibrate`.

Run stalls at 0% after 'Error: Get ...: context deadline exceeded'Cause 2/2

Possible causes

  • Timeouts, proxy in the environment, or the target rate-limiting.

Usual fix

Raise `--timeout`, lower `-t`, and unset `HTTP_PROXY` if a stale environment value is set.

Tips

  • Start with a small list; the first 5,000 entries produce most findings.
  • Log the exact command and wordlist path — reproducing a discovery run later means reproducing its input too.
  • For a whole application, `dir` then `vhost` then `fuzz` covers most of the cheap surface.

Alternatives & comparisons

Not documented yet: feroxbuster. Request an entry and it will link up automatically.Request a tool

References

Where to verify anything on this page. External links open in a new tab.

Found something wrong?Suggest an editMore in Pentesting

Looking for alternatives?

ffuf cover adjacent parts of the same job.

Compare side by side