Gobuster
Fast directory/DNS/vhost brute-forcer.
KaliParrotmedium
pkg: gobuster
Gobuster brute-forces URIs, DNS subdomains and virtual hosts using wordlists, written in Go for speed.
Syntax
gobuster dir -u {url} -w {wordlist}
Example
gobuster dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt
Brute-forces directories/files on the site using the common.txt wordlist.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
gobuster dir
Usage examples
gobuster dir -u https://target.tld -w common.txt
Brute-force directories/files.
gobuster dir -u https://target.tld -w big.txt -x php,bak -t 50
Add extensions and more threads.
gobuster dns -d target.tld -w subdomains.txt
Brute-force subdomains (DNS mode).
Advantages
- Very fast (Go concurrency)
- dir/dns/vhost modes
- Simple, scriptable flags
Disadvantages
- No recursion by default
- Noisy — many requests
- Wordlist quality is everything
Tags
#web#fuzzing#content-discovery
Official docs: Gobuster ↗
Related commands
Frequently asked questions
What is Gobuster used for?
Gobuster brute-forces URIs, DNS subdomains and virtual hosts using wordlists, written in Go for speed.
What is an example Gobuster command?
A common example is: gobuster dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt — Brute-forces directories/files on the site using the common.txt wordlist.
Is Gobuster part of Kali Linux?
Yes. Gobuster ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install gobuster.
What category of security tool is Gobuster?
Gobuster is a Web Application tool with a medium-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.