# Gobuster

> Auth/lab ref: Directory, DNS subdomain, and vhost brute-forcer written in Go. For enumerate web directories, find hidden paths, brute-force subdomains via DNS, or discover virtual hosts on a web server.

- Skill: `aeondave/gobuster` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aeondave/gobuster`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/gobuster/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: Apache-2.0
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/gobuster

---


# Gobuster

Go-based brute-forcer for directories, DNS, and vhosts.

## Quick Start

```bash
# Directory brute-force
gobuster dir -u http://example.com -w /usr/share/wordlists/dirb/common.txt

# DNS subdomain enumeration
gobuster dns -d example.com -w /usr/share/wordlists/subdomains.txt

# Virtual host discovery
gobuster vhost -u http://example.com -w /usr/share/wordlists/subdomains.txt
```

## Modes

| Mode | Description |
|------|-------------|
| `dir` | Directory/file enumeration |
| `dns` | DNS subdomain brute-force |
| `vhost` | Virtual host discovery |
| `fuzz` | Generic fuzzing (URL path/param) |
| `s3` | Enumerate open S3 buckets |
| `gcs` | Google Cloud Storage buckets |

## Dir Mode Flags

| Flag | Description |
|------|-------------|
| `-u <url>` | Target URL |
| `-w <wordlist>` | Wordlist path |
| `-t <n>` | Threads (default 10) |
| `-x <ext>` | File extensions (e.g., `php,html,txt`) |
| `-s <codes>` | Allowed status codes (default `200,204,301,302,307,401,403`) |
| `-b <codes>` | Blacklist status codes |
| `-r` | Follow redirects |
| `-k` | Skip TLS verification |
| `-H <header>` | Custom header (e.g., `"Authorization: Bearer TOKEN"`) |
| `-c <cookie>` | Add cookie |
| `--timeout <duration>` | HTTP timeout (e.g., `10s`) |
| `-o <file>` | Output file |
| `-q` | Quiet (no banner) |
| `--no-error` | Suppress errors |
| `--add-slash` | Append `/` to each request |
| `-e` | Expanded mode (print full URLs) |
| `--exclude-length <n>` | Exclude responses of this length |
| `-n` | No status codes in output |

## DNS Mode Flags

| Flag | Description |
|------|-------------|
| `-d <domain>` | Target domain |
| `-w <wordlist>` | Wordlist |
| `-r <resolver>` | Custom DNS resolver |
| `--wildcard` | Force continue on wildcard DNS |
| `--show-ips` | Show IPs with results |
| `--show-cname` | Show CNAME records |

## Vhost Mode Flags

| Flag | Description |
|------|-------------|
| `-u <url>` | Base URL |
| `-w <wordlist>` | Wordlist of subdomains |
| `--append-domain` | Append base domain to wordlist entries |
| `--domain <domain>` | Domain to append (if different from -u) |
| `--exclude-length <n>` | Exclude specific response size (filter default response) |

## Common Workflows

```bash
# Dir enum with extensions, output to file
gobuster dir -u https://target.com -w common.txt -x php,html,bak -o dirs.txt -q

# Dir enum behind auth
gobuster dir -u https://target.com -w common.txt -H "Authorization: Bearer <token>"

# Recursive-style: pipe back interesting dirs
gobuster dir -u https://target.com/api/ -w api-endpoints.txt -x json

# DNS with custom resolver
gobuster dns -d target.com -w subdomains-top1m.txt -r 8.8.8.8 -t 50

# Vhost discovery (append domain for non-matching)
gobuster vhost -u http://target.com -w subdomains.txt --append-domain

# Vhost — filter out default response size
gobuster vhost -u http://target.com -w subdomains.txt --append-domain --exclude-length 12345

# S3 bucket enumeration
gobuster s3 -w bucket-names.txt

# Fuzz mode (generic, FUZZ in URL)
gobuster fuzz -u https://target.com/FUZZ -w wordlist.txt -b 404
```

## Useful Wordlists

- `/usr/share/wordlists/dirb/common.txt` — general dirs
- `/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt` — comprehensive
- `SecLists/Discovery/Web-Content/raft-medium-directories.txt` — raft lists
- `SecLists/Discovery/DNS/subdomains-top1million-5000.txt` — DNS

## Resources

| File | When to load |
|------|--------------|
| `references/wordlists.md` | Recommended wordlists per mode and target type |