Directory, file, DNS and Vhost enumeration with GoBuster

What is Gobuster?

Gobuster is an open-source offensive tool used to enumerate directories, DNS subdomains, Vhosts and more by brute force.

Enumeration means listing all available directories/files/subdomains where they are accessible or not through brute force, trying every possibility from a wordlist until a match is found.

Directory Enumeration

First, DNS is the phonebook of the internet. It allows us to look up domains by their domains names rather than having to memorize their IP addresses. For example, you search up "google.com" and a DNS server matches that with 8.8.8.8

Since we're working in a test enviroment, I'll switch my machine's DNS server to a custom one by editing the dnsmasq file.

As you can see, we have the default DNS server already set inside

We'll add our lab machine's target IP to the top of the list

And finally, put the changes into action

Alright, let's get to work. First, let's review Gobuster's manual to write out our command.

First, are the modes we can use, this lets Gobuster know whether we're enumerating over directories, DNS subdomains, etc.

And flags to set our options in place.

Alright, let's write our command. We're going to enumerate over the directories in www.offensivetools.thm using:

gobuster dir -u "www.offensivetools.thm" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 64

Its very simple, gobuster dir to set it in directory mode, -u sets the url, -w sets the path to the wordlist and -t 64 assigns 64 threads to gobuster so it runs a little faster.

We found our suspicious directory!

Now let's enumerate over this path for any interesting files.

It's mostly the same, all we've changed is adding the /secret path to the url, and appending -x .js to have it search for files ending with .js

There's our flag! Let's go fetch and read it.

DNS Subdomain enumeration

The difference is minimal, all we'll do is switch to the dns mode, and use the -d flag for the directory

And we'll get a list of subdomains that responded with 200 OK

Vhost Enumeration

This command is abit of a mouthfull, but it isnt too bad.

gobuster vhost -u "http://10.112.139.17" --domain offensivetools.thm -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain --exclude-length 250-320

Essentially we've changed the mode to vhost, added the IP address to the -u flag, mentioned the --domain and importantly --append-domain

Without the --append-domain flag, it'll add the word from the wordlist as is to the Host header.

For example:

Word #1 is "Store"

It responds with:

GET / HTTP/1.1
Host: store <------- (notice the lone word)
User-Agent: gobuster/3.6
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive

Instead of:

GET / HTTP/1.1
Host: store.example.com  <------- (domain is appended)
User-Agent: gobuster/3.6
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive