Gobuster

Gobuster

Purpose

Use this skill for focused content, DNS, or virtual host discovery once the base scope is already confirmed.

Phase Fit

• Primary: Discovery and Reconnaissance, Vulnerability Analysis
• Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

Use When

• Need to identify hidden directories, files, or virtual hosts.
• Need a faster CLI option than a GUI enumerator.
• Need to retest whether sensitive content is still exposed.

Avoid When

• The web target is fragile or rate limits are unclear.
• Wordlist-driven probing would exceed the approved impact level.

Inputs

• Confirmed base URL, host, or domain
• Narrow wordlist aligned to the hypothesis
• Rate limits and exclusion paths

Procedure

1. Start with the smallest mode and wordlist that match the hypothesis.
2. Keep authenticated and unauthenticated coverage separate.
3. Review responses for real exposure rather than status noise.
4. Escalate only the most credible paths to manual validation.
5. Save the exact path set needed for retest.

Command Syntax

Replace sample targets with approved in-scope assets.

# Directory and file bruteforce
gobuster dir -u https://portal.contoso.com -w /usr/share/seclists/Discovery/Web-Content/common.txt -o contoso-dirs.txt

# Include file extension fuzzing
gobuster dir -u https://portal.contoso.com -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt -x php,aspx,html,txt -o contoso-ext.txt

# DNS subdomain enumeration
gobuster dns -d contoso.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -o contoso-dns.txt

# Virtual host enumeration
gobuster vhost -u https://contoso.com -w vhosts.txt --append-domain

# Authenticated scan with Bearer token
gobuster dir -u https://portal.contoso.com -w paths.txt -H "Authorization: Bearer <token>" -t 20

# Throttle threads to avoid alerts
gobuster dir -u https://portal.contoso.com -w paths.txt -t 5 -o contoso-slow.txt

Evidence to Capture

• Newly identified directories, files, or virtual hosts
• Response patterns that indicate hidden functionality
• Exact routes or hosts to retest later

Safety Boundaries

• Throttle requests and respect outage-sensitive applications.
• Do not widen wordlists or recursion depth unless the phase objective justifies it.