AeonDave Gobuster
Go-based brute-forcer for directories, DNS, and vhosts.
Quick Start
# Directory brute-force
gobuster dir -u http://example.com -w /usr/share/wordlists/dirb/common.txt
# DNS subdomain enumeration
gobuster dns -d example.com -w /usr/share/wordlists/subdomains.txt
# Virtual host discovery
gobuster vhost -u http://example.com -w /usr/share/wordlists/subdomains.txt
Modes
| Mode | Description |
|---|---|
dir |
Directory/file enumeration |
dns |
DNS subdomain brute-force |
vhost |
Virtual host discovery |
fuzz |
Generic fuzzing (URL path/param) |
s3 |
Enumerate open S3 buckets |
gcs |
Google Cloud Storage buckets |
Dir Mode Flags
| Flag | Description |
|---|---|
-u <url> |
Target URL |
-w <wordlist> |
Wordlist path |
-t <n> |
Threads (default 10) |
-x <ext> |
File extensions (e.g., php,html,txt) |
-s <codes> |
Allowed status codes (default 200,204,301,302,307,401,403) |
-b <codes> |
Blacklist status codes |
-r |
Follow redirects |
-k |
Skip TLS verification |
-H <header> |
Custom header (e.g., "Authorization: Bearer TOKEN") |
-c <cookie> |
Add cookie |
--timeout <duration> |
HTTP timeout (e.g., 10s) |
-o <file> |
Output file |
-q |
Quiet (no banner) |
--no-error |
Suppress errors |
--add-slash |
Append / to each request |
-e |
Expanded mode (print full URLs) |
--exclude-length <n> |
Exclude responses of this length |
-n |
No status codes in output |
DNS Mode Flags
| Flag | Description |
|---|---|
-d <domain> |
Target domain |
-w <wordlist> |
Wordlist |
-r <resolver> |
Custom DNS resolver |
--wildcard |
Force continue on wildcard DNS |
--show-ips |
Show IPs with results |
--show-cname |
Show CNAME records |
Vhost Mode Flags
| Flag | Description |
|---|---|
-u <url> |
Base URL |
-w <wordlist> |
Wordlist of subdomains |
--append-domain |
Append base domain to wordlist entries |
--domain <domain> |
Domain to append (if different from -u) |
--exclude-length <n> |
Exclude specific response size (filter default response) |
Common Workflows
# Dir enum with extensions, output to file
gobuster dir -u https://target.com -w common.txt -x php,html,bak -o dirs.txt -q
# Dir enum behind auth
gobuster dir -u https://target.com -w common.txt -H "Authorization: Bearer <token>"
# Recursive-style: pipe back interesting dirs
gobuster dir -u https://target.com/api/ -w api-endpoints.txt -x json
# DNS with custom resolver
gobuster dns -d target.com -w subdomains-top1m.txt -r 8.8.8.8 -t 50
# Vhost discovery (append domain for non-matching)
gobuster vhost -u http://target.com -w subdomains.txt --append-domain
# Vhost — filter out default response size
gobuster vhost -u http://target.com -w subdomains.txt --append-domain --exclude-length 12345
# S3 bucket enumeration
gobuster s3 -w bucket-names.txt
# Fuzz mode (generic, FUZZ in URL)
gobuster fuzz -u https://target.com/FUZZ -w wordlist.txt -b 404
Useful Wordlists
/usr/share/wordlists/dirb/common.txt— general dirs/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt— comprehensiveSecLists/Discovery/Web-Content/raft-medium-directories.txt— raft listsSecLists/Discovery/DNS/subdomains-top1million-5000.txt— DNS
Resources
| File | When to load |
|---|---|
references/wordlists.md |
Recommended wordlists per mode and target type |