BeginnerTools

Gobuster Guide: Directory and DNS Busting Tool

Learn how to use Gobuster for directory and file discovery on web servers, DNS subdomain enumeration, and virtual host discovery.

#gobuster#directory busting#DNS enumeration#web enumeration#content discovery

Why You Need Gobuster

You need to discover hidden directories, files, or subdomains on a web target — Gobuster brute-forces them faster than any alternative. Built in Go for maximum concurrency, it handles directory/file discovery, DNS subdomain enumeration, and virtual host brute-forcing in a single tool.

Prerequisites

Basic understanding of HTTP and web servers

Familiarity with DNS concepts

Wordlists for directory/file brute-forcing

A target web application for testing

Explicit permission to test the target

How Gobuster Works

Gobuster operates in three primary modes:

Directory/File Mode: Sends HTTP requests to a target server using paths from a wordlist and reports those that return specific status codes.

DNS Mode: Queries DNS servers for subdomains from a wordlist and reports those that resolve.

VHOST Mode: Sends requests with different Host headers to identify virtual hosts on the same IP address.

Installation

Gobuster comes pre-installed on Kali Linux:

# Debian/Ubuntu
sudo apt install gobuster

# From source
sudo apt install golang-go
go install github.com/OJ/gobuster/v3@latest

Basic Usage

Directory Busting Mode

gobuster dir -u http://target.com -w /usr/share/wordlists/dirb/common.txt

Key Options

| Option | Description |

|--------|-------------|

| -u URL | Target URL |

| -w WORDLIST | Path to wordlist |

| -x EXTENSIONS | File extensions to check |

| -t THREADS | Concurrent threads (default 10) |

| -s STATUS_CODES | Status codes to include |

| -k | Skip TLS verification |

| -o FILE | Output file |

DNS Subdomain Mode

gobuster dns -d target.com -w /usr/share/wordlists/dirb/common.txt

VHOST Mode

gobuster vhost -u http://target.com -w /usr/share/wordlists/dirb/common.txt

Directory Busting Examples

# Basic scan
gobuster dir -u http://192.168.1.100 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

# With file extensions
gobuster dir -u http://192.168.1.100 -w /usr/share/wordlists/dirb/common.txt -x php,html,txt,asp

# Custom status codes
gobuster dir -u http://192.168.1.100 -w wordlist.txt -s "200,204,301,302,307,401,403"

DNS Subdomain Examples

gobuster dns -d example.com -w /usr/share/wordlists/dirb/common.txt
gobuster dns -d example.com -w subdomains.txt -r 8.8.8.8

Real-World Example: Full Web Reconnaissance

# Step 1: Scan for directories
gobuster dir -u http://target.com -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -x php,html,txt -t 50 -o directories.txt

# Step 2: Discover subdomains
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t 30 -o subdomains.txt

# Step 3: Check for virtual hosts
gobuster vhost -u http://target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t 30 -o vhosts.txt

Common Mistakes

Using Wrong Wordlist

Small wordlists miss many valid paths. Use medium or large wordlists.

Not Specifying Extensions

Always specify likely extensions with -x.

Too Many Threads

Start with 50 threads and adjust based on target response.

Best Practices

Use targeted wordlists: Choose based on target technology.

Check robots.txt first: Always check /robots.txt before scanning.

Combine with other tools: Use Nmap for discovery, then Gobuster.

Related Tools

**Dirb**: Another directory brute-forcer

**Ffuf**: Faster, more flexible fuzzing tool

**Dirsearch**: Python-based directory brute-forcer

[Dirb Guide](/articles/dirb-guide)

[Ffuf Guide](/articles/ffuf-guide)

[Nmap Beginner Tutorial](/articles/nmap-beginner-tutorial)

[WhatWeb Guide](/articles/whatweb-guide)

Summary

Gobuster is a fast, efficient tool for web content discovery through directory, DNS, and virtual host brute-forcing. Its Go-based architecture delivers excellent performance with concurrent requests.

Knowledge Check

What are the three operating modes of Gobuster?

Why is Gobuster faster than similar tools like Dirb?

What does the `-x` flag do in directory mode?

How does VHOST mode differ from DNS mode?

Why should you check robots.txt before scanning?

Frequently Asked Questions

What is Gobuster and what does it do?

Gobuster is a fast, Go-based tool for brute-forcing URIs (directories and files), DNS subdomains, and virtual host names on web servers. Its concurrent request architecture makes it significantly faster than similar tools like Dirb for web content discovery.

What are the three operating modes of Gobuster?

Directory/File mode discovers hidden paths on web servers, DNS mode enumerates subdomains by querying DNS servers, and VHOST mode identifies virtual hosts by sending requests with different Host headers to the same IP address.

Why is Gobuster faster than Dirb?

Gobuster is written in Go, which uses efficient concurrency with goroutines for parallel HTTP requests. Dirb is written in C and uses sequential requests. Go's concurrency model allows Gobuster to handle many more simultaneous connections efficiently.

What does the `-x` flag do in directory mode?

The `-x` flag specifies file extensions to append to each wordlist entry (e.g., `-x php,html,txt`). This tests for files like `admin.php`, `admin.html`, and `admin.txt` instead of just directories, significantly improving discovery coverage.

How does VHOST mode differ from DNS mode?

DNS mode queries DNS servers for subdomain resolution, finding subdomains that have DNS records. VHOST mode sends HTTP requests with different Host headers to find virtual hosts sharing the same IP, which may not have public DNS records.

Why should you check robots.txt before scanning?

robots.txt often reveals directories the site owner wants hidden from search engines, which are frequently the same paths valuable to attackers. Checking it first provides free intelligence and reduces the need for aggressive scanning.

What wordlists are best for Gobuster directory busting?

Use directory-list-2.3-medium.txt from SecLists for general web content, common.txt from dirb for quick scans, and technology-specific lists for targeted discovery. Wordlist choice directly impacts what you find.

What do different HTTP status codes mean in Gobuster output?

200 means the path exists and returned content, 301/302 are redirects, 401 is unauthorized (protected), 403 is forbidden (access denied but path exists), and 404 is not found. Focus on 200, 301, 302, 401, and 403 results.

How do you handle rate limiting with Gobuster?

Reduce thread count with `-t` (start with 10-20), add delays between requests, and use `-delay` if available. High thread counts against rate-limited servers produce errors and may trigger IP blocking or WAF rules.

Can Gobuster test for specific file extensions?

Yes, use `-x` with comma-separated extensions (e.g., `-x php,asp,jsp,html,txt`). This is essential for finding hidden files like configuration files, backup files, and scripts that directory-only scans would miss.