Gobuster Commands & Tutorial 2026 — Complete Web Enumeration Guide
Complete Gobuster guide covering authorized web and DNS enumeration, directory discovery, virtual-host testing, troubleshooting, and cybersecurity lab workflows.
What Is Gobuster?
Gobuster is an open-source command-line enumeration tool used by security professionals to discover directories, files, DNS records, and virtual hosts during authorized security assessments. It is particularly useful during the reconnaissance and enumeration stages of web application penetration testing.
What is Gobuster used for? Security professionals use Gobuster for authorized web directory enumeration, DNS subdomain discovery, virtual host discovery, and web reconnaissance in controlled cybersecurity assessments.
The basic workflow is: identify the target → choose the enumeration mode (dir, dns, vhost) → select a wordlist → run Gobuster → analyze results → document findings.
Featured Snippet Answers
What is Gobuster used for?
Gobuster is used for authorized web directory enumeration, DNS subdomain discovery, virtual host discovery, and web reconnaissance during cybersecurity assessments.
Is Gobuster legal?
Gobuster itself is legal software. Testing systems you own or have explicit written authorization to test is legal; testing systems without authorization is illegal.
Is Gobuster installed on Kali Linux?
Yes — Gobuster is pre-installed on Kali Linux. It can also be installed via sudo apt install gobuster.
What modes does Gobuster support?
Gobuster supports three main modes: dir (directory/file enumeration), dns (DNS subdomain enumeration), and vhost (virtual host enumeration).
What is the difference between Gobuster and FFUF?
Both are web fuzzing tools. Gobuster is simpler and more focused on directory and DNS enumeration. FFUF is faster and more flexible for complex fuzzing scenarios.
Gobuster Tutorial for Beginners
Gobuster is one of the most popular web enumeration tools used by security professionals. It helps map the attack surface of web applications by discovering hidden directories, files, DNS subdomains, and virtual hosts.
Why Web Enumeration Matters
Web enumeration is a critical phase of any security assessment. It helps identify:
- Hidden directories: Admin panels, backup directories, configuration files
- Unlinked files: Backup files, log files, source code repositories
- Subdomains: Development, staging, and internal subdomains
- Virtual hosts: Other applications hosted on the same server
- Additional attack surface: Endpoints that aren’t linked from the main application
How to Install Gobuster
Kali Linux
sudo apt update sudo apt install gobuster
Ubuntu and Debian
sudo apt update sudo apt install gobuster
macOS
brew install gobuster
From Source (Go)
go install github.com/OJ/gobuster/v3@latest
Verify the Installation
gobuster --version # Show help gobuster --help
Gobuster Syntax
gobuster [mode] [options]
| Mode | Purpose | Example |
|---|---|---|
dir | Directory/file enumeration | gobuster dir -u http://target.com -w wordlist.txt |
dns | DNS subdomain enumeration | gobuster dns -d target.com -w wordlist.txt |
vhost | Virtual host enumeration | gobuster vhost -u http://target.com -w wordlist.txt |
Common Options
| Option | Purpose | Example |
|---|---|---|
-u | Target URL (dir/vhost) | -u http://target.com |
-d | Domain (DNS mode) | -d target.com |
-w | Wordlist path | -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt |
-x | File extensions | -x php,html,txt |
-t | Threads | -t 50 |
-s | Status codes to include | -s 200,301,302 |
-k | Skip SSL verification | -k |
-r | Follow redirects | -r |
-q | Quiet mode | -q |
-o | Output file | -o results.txt |
-v | Verbose output | -v |
Basic Gobuster Commands
Show Help
gobuster --help
gobuster dir --help
gobuster dns --help
gobuster vhost --help
Directory Enumeration
gobuster dir -u http://target.com -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt
With File Extensions
gobuster dir -u http://target.com -w wordlist.txt -x php,html,txt,js,css
With Status Code Filtering
gobuster dir -u http://target.com -w wordlist.txt -s 200,301,302
Exclude Status Codes
gobuster dir -u http://target.com -w wordlist.txt -b 404
With Threads and Output
gobuster dir -u http://target.com -w wordlist.txt -t 50 -o results.txt
With Cookie Authentication
gobuster dir -u http://target.com -w wordlist.txt -c "session=abc123; security=low"
With Proxy
gobuster dir -u http://target.com -w wordlist.txt --proxy http://127.0.0.1:8080
-t to control speed and avoid detection.
DNS Enumeration
gobuster dns -d target.com -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt
gobuster dns -d target.com -w wordlist.txt -o dns_results.txt
gobuster dns -d target.com -w wordlist.txt --resolver 8.8.8.8
Understanding DNS Output
| Column | Description |
|---|---|
| Found: | Subdomain discovered |
| Status: | DNS resolution status |
| Record: | IP address of the subdomain |
Virtual Host Enumeration
gobuster vhost -u http://target.com -w /usr/share/wordlists/SecLists/Discovery/Web-Content/raft-small-words.txt
gobuster vhost -u http://target.com -w wordlist.txt --header "User-Agent: Gobuster"
gobuster vhost -u http://target.com -w wordlist.txt -o vhost_results.txt
Wordlists and Extensions
Recommended Wordlist Locations
| Wordlist | Location | Use Case |
|---|---|---|
| Dirbuster medium | /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt | General directory enumeration |
| SecLists Discovery | /usr/share/wordlists/SecLists/Discovery/Web-Content/ | Comprehensive web content discovery |
| Raft | /usr/share/wordlists/SecLists/Discovery/Web-Content/raft-*.txt | Various wordlists for different purposes |
| Common | /usr/share/wordlists/common.txt | Small, fast wordlist for quick scans |
| Subdomains | /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt | DNS subdomain discovery |
Common File Extensions
| Extension | Description |
|---|---|
.php | PHP files (common in web applications) |
.html | HTML files |
.txt | Text files (robots.txt, readme, etc.) |
.js | JavaScript files |
.css | CSS files |
.bak | Backup files |
.old | Old versions |
.zip | Compressed archives |
.sql | SQL database dumps |
.log | Log files |
# Standard web extensions -x php,html,txt,js,css # Backup and sensitive files -x bak,old,zip,sql,log,conf,config # All common extensions -x php,html,txt,js,css,bak,old,zip,sql,log,conf,config,xml,json,yml
HTTP Status Codes
| Status Code | Meaning | Action |
|---|---|---|
| 200 OK | Resource found and accessible | Investigate the resource |
| 301 Moved Permanently | Resource has been moved | Follow redirect to find new location |
| 302 Found | Temporary redirect | Follow redirect to find new location |
| 401 Unauthorized | Authentication required | Investigate potential authentication bypass |
| 403 Forbidden | Access denied | Investigate potential privilege escalation |
| 404 Not Found | Resource not found | Ignore or exclude from results |
| 500 Internal Server Error | Server error | Investigate for potential injection |
| 502 Bad Gateway | Proxy/gateway error | May indicate misconfiguration |
# Include specific status codes gobuster dir -u http://target.com -w wordlist.txt -s 200,301,302 # Exclude status codes gobuster dir -u http://target.com -w wordlist.txt -b 404,403
Response Size and Filtering
# Exclude responses of a specific size (e.g., 404 pages) gobuster dir -u http://target.com -w wordlist.txt -l --exclude-size=1234
gobuster dir -u http://target.com -w wordlist.txt -l
gobuster dir -u http://target.com -w wordlist.txt -b 404 -x php --exclude-size=1234
Authentication Considerations
gobuster dir -u http://target.com -w wordlist.txt -c "session=abc123; security=low"
gobuster dir -u http://target.com -w wordlist.txt --username admin --password password123
gobuster dir -u http://target.com -w wordlist.txt -H "Authorization: Bearer token123"
HTTPS and TLS Options
gobuster dir -u https://target.com -w wordlist.txt -k
gobuster dir -u http://target.com -w wordlist.txt -r
gobuster dir -u https://target.com -w wordlist.txt --tls-cert cert.pem --tls-key key.pem
-k when testing self-signed or internal certificates to avoid SSL errors.
Common Gobuster Errors & Solutions
| Error | Possible Cause | Solution |
|---|---|---|
No wordlist provided | -w option missing | Add -w /path/to/wordlist.txt |
Target URL required | -u option missing | Add -u http://target.com |
Could not connect to target | Target unreachable | Verify URL, network, and firewall |
Too many open files | High thread count | Reduce -t value |
SSL certificate verification failed | Self-signed certificate | Add -k to skip verification |
DNS resolution failed | DNS issue | Verify DNS; use --resolver |
Permission denied | File permission | Check wordlist permissions |
Gobuster vs Other Tools
| Tool | Primary Purpose |
|---|---|
| Gobuster | Web and DNS enumeration |
| FFUF | Fast web fuzzing |
| Dirsearch | Web path discovery |
| Nmap | Network and service discovery |
| Burp Suite | Web application security testing |
Gobuster vs FFUF
Gobuster
- Simpler syntax
- Built-in DNS and vhost modes
- Good for basic enumeration
- Written in Go (fast)
FFUF
- More flexible fuzzing
- Faster performance
- Complex filtering options
- Customizable request patterns
Gobuster vs Dirsearch
Gobuster
- Multiple modes (dir, dns, vhost)
- Go implementation (fast)
- Simple command structure
- Good for quick scans
Dirsearch
- Python-based
- More output formats
- Built-in proxy support
- Extensive customization
Authorized Web Enumeration Lab
Scenario
You are conducting an authorized web application assessment on a lab target to discover hidden directories and files.
Step 1 — Identify the Target
http://192.168.1.100:8080
Step 2 — Basic Directory Enumeration
gobuster dir -u http://192.168.1.100:8080 -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -t 20
Step 3 — Add File Extensions
gobuster dir -u http://192.168.1.100:8080 -w wordlist.txt -x php,html,txt,js -t 20
Step 4 — Filter Results
gobuster dir -u http://192.168.1.100:8080 -w wordlist.txt -x php -b 404 -o results.txt
Step 5 — DNS Enumeration
gobuster dns -d target.com -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt
Step 6 — Analyze Results
/admin (Status: 200) /login.php (Status: 200) /backup.sql (Status: 200) /robots.txt (Status: 200) /hidden (Status: 301) /api (Status: 200)
Step 7 — Validate Findings
Manually verify each discovered resource:
- /admin: Admin panel — check for default credentials
- /login.php: Login page — test for SQL injection
- /backup.sql: Database dump — contains sensitive data
- /robots.txt: Contains disallowed directories
- /api: API endpoints — test for security issues
Step 8 — Report Findings
Document findings and remediation recommendations:
- Vulnerability: Exposed backup.sql file
- Risk: Data exposure, credential compromise
- Remediation: Remove backup files, restrict directory access
- Vulnerability: Exposed admin panel
- Risk: Unauthorized access
- Remediation: Restrict access to admin panel by IP, implement MFA
Web Enumeration Best Practices
Start Small
Begin with smaller, targeted wordlists for speed. Expand wordlist size as needed based on initial results.
Use Appropriate Threads
Start with -t 20 and increase gradually. Avoid overwhelming the target server.
Filter Out Noise
Use -b to exclude common error codes (404, 403) and --exclude-size to filter uniform responses.
Save Results
Always use -o to save results for reporting and evidence collection.
Verify Findings
Manually verify all discovered resources before including them in reports.
Respect Rate Limiting
Monitor target response times and adjust -t to avoid triggering rate limiting or WAF blocks.
Document Everything
Document commands used, outputs, findings, and remediation recommendations.
Use Appropriate Wordlists
Choose wordlists based on the target’s technology stack and language.
Gobuster Cheat Sheet
| Purpose | Command |
|---|---|
| Help | gobuster --help |
| Version | gobuster --version |
| Directory enum | gobuster dir -u http://target.com -w wordlist.txt |
| Directory with extensions | gobuster dir -u http://target.com -w wordlist.txt -x php,html,txt |
| DNS enum | gobuster dns -d target.com -w wordlist.txt |
| Vhost enum | gobuster vhost -u http://target.com -w wordlist.txt |
| With threads | gobuster dir -u http://target.com -w wordlist.txt -t 50 |
| With output | gobuster dir -u http://target.com -w wordlist.txt -o results.txt |
| Status code filter | gobuster dir -u http://target.com -w wordlist.txt -s 200,301 |
| Exclude status | gobuster dir -u http://target.com -w wordlist.txt -b 404 |
| Cookie auth | gobuster dir -u http://target.com -w wordlist.txt -c "session=abc123" |
| Basic auth | gobuster dir -u http://target.com -w wordlist.txt --username admin --password pass |
| Skip SSL | gobuster dir -u https://target.com -w wordlist.txt -k |
| Follow redirects | gobuster dir -u http://target.com -w wordlist.txt -r |
| Proxy | gobuster dir -u http://target.com -w wordlist.txt --proxy http://127.0.0.1:8080 |
| Response length | gobuster dir -u http://target.com -w wordlist.txt -l |
| Exclude size | gobuster dir -u http://target.com -w wordlist.txt --exclude-size=1234 |
Frequently Asked Questions About Gobuster
What is Gobuster?
Gobuster is an open-source command-line enumeration tool used to discover directories, files, DNS records, and virtual hosts during authorized security assessments.
Is Gobuster legal?
Gobuster is legal software. Testing systems you own or have explicit written authorization to test is legal; testing systems without authorization is illegal.
Is Gobuster installed on Kali Linux?
Yes — Gobuster is pre-installed on Kali Linux.
What modes does Gobuster support?
Gobuster supports dir (directory/file enumeration), dns (DNS subdomain enumeration), and vhost (virtual host enumeration).
What is the difference between Gobuster and FFUF?
Gobuster is simpler and focused on enumeration. FFUF is faster and more flexible for complex fuzzing scenarios.
What is the difference between Gobuster and Dirsearch?
Gobuster is written in Go (faster) and supports multiple modes. Dirsearch is Python-based with more output formats.
How do I use Gobuster for directory enumeration?
gobuster dir -u http://target.com -w wordlist.txt
How do I use Gobuster for DNS enumeration?
gobuster dns -d target.com -w wordlist.txt
How do I use Gobuster with file extensions?
gobuster dir -u http://target.com -w wordlist.txt -x php,html,txt
How do I filter status codes in Gobuster?
gobuster dir -u http://target.com -w wordlist.txt -s 200,301 or -b 404
Can Gobuster handle authenticated enumeration?
Yes — use -c for cookies, --username and --password for basic auth, or -H for custom headers.
How do I save Gobuster results?
Use -o results.txt to save output to a file.
How do I use Gobuster with a proxy?
gobuster dir -u http://target.com -w wordlist.txt --proxy http://127.0.0.1:8080
What wordlist should I use with Gobuster?
Start with Dirbuster medium or SecLists for general enumeration. Use specific wordlists based on the target technology.
Can beginners learn Gobuster?
Yes — Gobuster has a simple syntax and is a great tool for learning web enumeration.
How can organizations defend against enumeration?
Implement proper access controls, use WAFs, monitor for suspicious patterns, limit information disclosure, and conduct regular security assessments.
Gobuster: Quick Expert Summary
Gobuster is a comprehensive web enumeration tool. It helps cybersecurity professionals discover hidden directories, files, DNS subdomains, and virtual hosts in authorized environments.
The most important concepts to learn are: directory enumeration, DNS enumeration, virtual host enumeration, wordlists, filtering, authentication, and responsible enumeration practices.
A professional workflow should always include authorization, targeted enumeration, evidence collection, manual verification, and remediation recommendations.
Official & Authoritative Resources
© A7 Security Hunters. Educational cybersecurity content. Use security tools only on systems, applications, and networks that you own or are explicitly authorized to assess.
Last Updated: August 2026
