DEV Community

Abhinav Singwal
Abhinav Singwal

Posted on

Gobuster in Practice: 20 Commands for Directory and DNS Enumeration

#gobuster #enumerationtool #cybersecuritytools #bugbountytools

Gobuster is a fast, lightweight enumeration tool written in Go. It is designed to brute-force hidden directories, files, DNS subdomains, virtual hosts, and cloud storage buckets. Its speed comes from concurrent threading, and its simplicity makes it a go-to utility during the reconnaissance phase of web application assessments. This guide covers twenty practical Gobuster commands, explaining what each does and when to apply it.

GoBuster Top 10 Commands

1. Basic Directory Brute Force 

gobuster dir -u http://example.com -w /usr/share/wordlists/dirb/common.txt
Enter fullscreen mode Exit fullscreen mode

The dir mode enumerates directories and files on a web server. The -u flag sets the target URL, and -w points to the wordlist. This is the foundational Gobuster command and the starting point for most web content discovery.

2. Include File Extensions 

gobuster dir -u http://example.com -w common.txt -x php,html,txt,bak
Enter fullscreen mode Exit fullscreen mode

The -x flag appends specific file extensions to each wordlist entry. This reveals backup files, configuration files, and script files that would otherwise be missed by directory-only enumeration.

3. Specify HTTP Status Codes to Show 

gobuster dir -u http://example.com -w common.txt -s 200,204,301,302,307,401,403
Enter fullscreen mode Exit fullscreen mode

The -s flag defines which status codes count as valid findings. By default Gobuster shows 200, 204, 301, 302, 307, 401, and 403. Customizing this list helps filter noise on applications with unusual response patterns.

4. Exclude Specific Status Codes 

gobuster dir -u http://example.com -w common.txt -b 404,403
Enter fullscreen mode Exit fullscreen mode

The -b flag excludes specified status codes from results. This is useful when a server returns 403 for everything, which would otherwise flood the output with false positives.

5. Set Custom User-Agent 

gobuster dir -u http://example.com -w common.txt -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
Enter fullscreen mode Exit fullscreen mode

The -a flag sets a custom User-Agent string. Some applications serve different content or block requests from default tool User-Agents. Spoofing a browser string can help bypass basic filtering.

6. Add Cookies for Authenticated Scanning 

gobuster dir -u http://example.com -w common.txt -c "PHPSESSID=abc123; security=low"
Enter fullscreen mode Exit fullscreen mode

The -c flag passes a cookie header with every request. This is essential for enumerating content behind authentication when you already have a valid session token.

7. Add Custom HTTP Headers 

gobuster dir -u http://example.com -w common.txt -H "X-Forwarded-For: 127.0.0.1"
Enter fullscreen mode Exit fullscreen mode

The -H flag adds custom headers. This is useful for testing header-based access controls, bypassing IP restrictions, or simulating requests from a reverse proxy.

8. Follow Redirects 

gobuster dir -u http://example.com -w common.txt -r
Enter fullscreen mode Exit fullscreen mode

The -r flag follows HTTP redirects. When a server returns a 301 or 302 to a valid location, following the redirect confirms whether the resource actually exists or leads to a dead end.

9. Control Thread Count 

gobuster dir -u http://example.com -w common.txt -t 50
Enter fullscreen mode Exit fullscreen mode

The -t flag sets the number of concurrent threads. The default is 10. Higher values speed up enumeration but increase load on the target and the risk of triggering rate limiting or WAF blocks.

10. Set Request Timeout 

gobuster dir -u http://example.com -w common.txt --timeout 20s
Enter fullscreen mode Exit fullscreen mode

The --timeout flag defines the maximum time to wait for a response. Increasing the timeout helps with slow applications. Decreasing it speeds up scans against responsive targets.

11. Expand Results with Verbose Mode 

gobuster dir -u http://example.com -w common.txt -v
Enter fullscreen mode Exit fullscreen mode

The -v flag enables verbose output, showing additional details such as response lengths and redirect targets. This helps distinguish genuine findings from soft 404 pages that return 200 status codes.

12. Quiet Mode for Clean Output 

gobuster dir -u http://example.com -w common.txt -q
Enter fullscreen mode Exit fullscreen mode

The -q flag suppresses the banner and progress indicators, showing only results. This is ideal for scripting and when piping output into other tools.

13. Save Results to a File 

gobuster dir -u http://example.com -w common.txt -o results.txt
Enter fullscreen mode Exit fullscreen mode

The -o flag writes output to a file. Always save enumeration results during assessments to maintain an audit trail and avoid repeating work.

14. DNS Subdomain Enumeration 

gobuster dns -d example.com -w /usr/share/wordlists/subdomains.txt
Enter fullscreen mode Exit fullscreen mode

The dns mode enumerates subdomains by querying DNS resolvers. The -d flag sets the target domain. This reveals additional attack surface such as development, staging, and administrative subdomains.

15. Show DNS CNAME Records 

gobuster dns -d example.com -w subdomains.txt -c
Enter fullscreen mode Exit fullscreen mode

The -c flag displays CNAME records alongside A records. CNAMEs can reveal cloud services, CDNs, and third-party integrations that expand the attack surface.

16. Use a Custom DNS Resolver 

gobuster dns -d example.com -w subdomains.txt -r 8.8.8.8
Enter fullscreen mode Exit fullscreen mode

The -r flag specifies a custom DNS resolver. Using a public resolver or a target-specific internal resolver can improve accuracy and speed when the default system resolver is unreliable.

17. Virtual Host Enumeration 

gobuster vhost -u http://example.com -w vhosts.txt
Enter fullscreen mode Exit fullscreen mode

The vhost mode enumerates virtual hosts on a web server. This reveals applications hosted on the same IP address but served under different hostnames, which are often overlooked during assessments.

18. Append Domain to Vhost Entries 

gobuster vhost -u http://example.com -w vhosts.txt --append-domain
Enter fullscreen mode Exit fullscreen mode

The --append-domain flag automatically appends the base domain to each wordlist entry. This saves preparation time when the wordlist contains only subdomain prefixes.

19. Exclude Response Length to Filter False Positives 

gobuster dir -u http://example.com -w common.txt --exclude-length 1234
Enter fullscreen mode Exit fullscreen mode

The --exclude-length flag filters out responses with a specific content length. When a server returns the same generic page for all invalid paths, excluding its length removes the noise and surfaces genuine findings.

20. Scan Google Cloud Storage Buckets 

gobuster bucket -w buckets.txt gcs
Enter fullscreen mode Exit fullscreen mode

The bucket mode enumerates cloud storage buckets. The final argument specifies the provider, such as gcs for Google Cloud Storage or s3 for Amazon S3. Publicly readable buckets frequently expose sensitive data and are a common finding in cloud assessments.

Explore More Tools

For a comprehensive collection of hacking tools, cheat sheets, and resources, visit my GitHub repository:

https://github.com/yogsec/Hacking-Tools/

Stay connected for more security content and updates:

https://linktr.ee/abhinavsingwal

Top comments (0)