# Gobuster

> Use for directory, DNS, and virtual host enumeration during authorized pentests. Trigger on hidden content discovery, vhost review, DNS brute-force within approved scope, and narrowing web attack surface gaps.

- Skill: `timsonner/gobuster` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/gobuster`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/gobuster/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/gobuster

---


# Gobuster

## Purpose

Use this skill for focused content, DNS, or virtual host discovery once the base scope is already confirmed.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

## Use When

- Need to identify hidden directories, files, or virtual hosts.
- Need a faster CLI option than a GUI enumerator.
- Need to retest whether sensitive content is still exposed.

## Avoid When

- The web target is fragile or rate limits are unclear.
- Wordlist-driven probing would exceed the approved impact level.

## Inputs

- Confirmed base URL, host, or domain
- Narrow wordlist aligned to the hypothesis
- Rate limits and exclusion paths

## Procedure

1. Start with the smallest mode and wordlist that match the hypothesis.
2. Keep authenticated and unauthenticated coverage separate.
3. Review responses for real exposure rather than status noise.
4. Escalate only the most credible paths to manual validation.
5. Save the exact path set needed for retest.

## Command Syntax

Replace sample targets with approved in-scope assets.

```bash
# Directory and file bruteforce
gobuster dir -u https://portal.contoso.com -w /usr/share/seclists/Discovery/Web-Content/common.txt -o contoso-dirs.txt

# Include file extension fuzzing
gobuster dir -u https://portal.contoso.com -w /usr/share/seclists/Discovery/Web-Content/raft-small-words.txt -x php,aspx,html,txt -o contoso-ext.txt

# DNS subdomain enumeration
gobuster dns -d contoso.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -o contoso-dns.txt

# Virtual host enumeration
gobuster vhost -u https://contoso.com -w vhosts.txt --append-domain

# Authenticated scan with Bearer token
gobuster dir -u https://portal.contoso.com -w paths.txt -H "Authorization: Bearer <token>" -t 20

# Throttle threads to avoid alerts
gobuster dir -u https://portal.contoso.com -w paths.txt -t 5 -o contoso-slow.txt
```

## Evidence to Capture

- Newly identified directories, files, or virtual hosts
- Response patterns that indicate hidden functionality
- Exact routes or hosts to retest later

## Safety Boundaries

- Throttle requests and respect outage-sensitive applications.
- Do not widen wordlists or recursion depth unless the phase objective justifies it.