Information Gathering

gobuster

gobuster finds the things that aren’t linked. Given a wordlist, it hammers a target with candidate names and reports which ones come back with a real response — hidden directories and files on a web server, subdomains in DNS, or virtual hosts on a single IP. It’s fast, written in Go, and mode-driven: you pick dir, dns, vhost, or one of the others, and it does that job.

Official-repo package; Security → Information Gathering → gobuster. Pair it with the wordlists in Password Attacks — SecLists in particular ships directory and DNS lists made for exactly this.

The help it prints

NAME:
   gobuster - the tool you love

USAGE:
   gobuster command [command options]

VERSION:
   3.8.2

AUTHORS:
   Christian Mehlmauer (@firefart)
   OJ Reeves (@TheColonial)

COMMANDS:
   dir      Uses directory/file enumeration mode
   vhost    Uses VHOST enumeration mode (you most probably want to use the IP address as the URL parameter)
   dns      Uses DNS subdomain enumeration mode
   fuzz     Uses fuzzing mode. Replaces the keyword FUZZ in the URL, Headers and the request body
   tftp     Uses TFTP enumeration mode
   s3       Uses aws bucket enumeration mode
   gcs      Uses gcs bucket enumeration mode
   help, h  Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --help, -h     show help
   --version, -v  print the version

Examples

# Directory and file discovery on a web server
gobuster dir -u http://10.0.0.5 -w /usr/share/seclists/Discovery/Web-Content/common.txt

# Look for common extensions too
gobuster dir -u http://10.0.0.5 -w wordlist.txt -x php,txt,html

# DNS subdomain brute force
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Virtual-host discovery against a single IP
gobuster vhost -u http://10.0.0.5 -w subdomains.txt --append-domain