Gobuster

Run 'gobuster dir -u http://example.com -w /usr/share/wordlists/dirb/common.txt' for directory brute forcing. For DNS enumeration: 'gobuster dns -d example.com -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt'. Gobuster is pre-installed on Kali Linux.

Gobuster supports three modes: 'dir' for directory and file brute forcing, 'dns' for subdomain enumeration via DNS, and 'vhost' for virtual host discovery. Each mode uses different wordlist types and serves a distinct purpose in web application reconnaissance.

Default wordlists are in '/usr/share/wordlists/'. For directory brute forcing use 'dirb/common.txt' or 'dirbuster/directory-list-2.3-medium.txt'. For DNS enumeration use 'seclists/Discovery/DNS/subdomains-top1million-5000.txt'. These are included with most Kali installations.

Gobuster is fastest for quick directory discovery and simple DNS enumeration. FFUF offers more advanced fuzzing with parameter injection and filtering. DIRB is simplest but slower. Use Gobuster for speed, FFUF for precision, and DIRB for basic scans.

On Kali Linux, Gobuster is pre-installed. On Ubuntu/Debian: 'sudo apt install gobuster'. From source: 'go install github.com/OJ/gobuster/v3@latest' (requires Go 1.18+). Docker: 'docker run ghcr.io/oj/gobuster:latest'.

Run 'gobuster vhost -u http://example.com -w /usr/share/wordlists/dirb/common.txt'. This sends Host headers with each wordlist entry and identifies virtual hosts by analyzing response differences. Useful for finding hidden admin panels on shared hosting.

Gobuster is a directory and file brute-forcing tool used to discover hidden paths on web servers. It supports three modes: directory brute force, DNS subdomain enumeration, and virtual host discovery.

Gobuster sends HTTP requests for each entry in a wordlist to the target URL. Based on HTTP response codes (200, 301, 403), it identifies existing paths, directories, and files that are not publicly linked.

Gobuster is simpler with dedicated dir, dns, and vhost modes. ffuf offers more advanced filtering, regex support, and faster performance but has a steeper learning curve.

Gobuster has basic options for rate limiting and user-agent spoofing, but it is not designed for advanced WAF evasion. For WAF bypass scenarios, tools like ffuf or wfuzz with custom payloads are more suitable.

For directory mode, use SecLists' common.txt or big.txt. For DNS mode, use subdomains-top1million-5000.txt. For vhost mode, use vhosts-top1mil-5000.txt. Always start with smaller lists and escalate to larger ones for thorough discovery.

Use the -b flag to exclude HTTP status codes (e.g., -b 404,403). Add -l to include response length in output for manual filtering. The -x flag can filter by file extension to reduce noise from irrelevant paths.

Yes, use gobuster dns -d target.com -w wordlist.txt to discover subdomains. The DNS mode queries for each subdomain in the wordlist and returns those that resolve. Combine with -r for custom DNS resolver configuration.

Gobuster is faster for simple directory discovery and has built-in DNS/vhost modes. ffuf offers advanced filtering and fuzzing capabilities. wfuzz provides more payload manipulation options. Gobuster is best for quick scans; ffuf/wfuzz for complex scenarios.

200 (OK) indicates the path exists. 301/302 (redirects) may indicate valid directories. 403 (Forbidden) often means the path exists but access is restricted. Use -b to exclude irrelevant codes and focus on meaningful results.

Use Gobuster with a curated wordlist in automated security checks. Set appropriate timeouts with -t and use exit codes to determine if new paths are discovered. Integrate with Jenkins or GitHub Actions for automated security regression testing.

Use -t to increase thread count (default is 10): gobuster dir -u http://target.com -w wordlist.txt -t 50. Higher threads increase speed but may overwhelm target servers or trigger WAFs. Start moderate and increase gradually.

Yes, use gobuster vhost mode: gobuster vhost -u http://192.168.1.1 -w wordlist.txt. This sends Host headers with each wordlist entry to discover additional virtual hosts hosted on the same IP address.

Use the --cookie flag to pass session cookies: gobuster dir -u http://target.com -w wordlist.txt --cookie "session=abc123". This allows scanning behind authentication by maintaining a valid session.

Yes, simply use https:// in the target URL: gobuster dir -u https://target.com -w wordlist.txt. Use --no-tls-validation to skip SSL certificate verification for self-signed or expired certificates.

Use -x to specify file extensions: gobuster dir -u http://target.com -w wordlist.txt -x php,html,txt. This appends each extension to wordlist entries, testing for example.php, example.html, etc.

Use --user-agent or -a to set a custom User-Agent string: gobuster dir -u http://target.com -w wordlist.txt -a 'Mozilla/5.0'. Some WAFs block requests with default Gobuster or Go user-agent strings.

Yes, use the -r flag to follow redirects from the target server. Without -r, Gobuster reports 301/302 responses without following them. Use -r when redirects point to the actual content you want to discover.

Gobuster accepts a single wordlist per scan. To use multiple wordlists, run separate scans or concatenate them: cat list1.txt list2.txt | sort -u > combined.txt, then use combined.txt as the wordlist.

For directory mode, use SecLists common.txt for quick scans, big.txt for thorough discovery, or raft-large-directories.txt for comprehensive coverage. Start with smaller lists and escalate based on results.