• Gobuster is an open-source offensive tool written in Golang.
  • It enumerates web directories, DNS subdomains, vhosts, Amazon S3 buckets, and Google Cloud Storage by brute force, using specific wordlists and handling the incoming responses.
  • Enumeration is the act of listing all the available resources, whether they are accessible or not. For example, Gobuster enumerates web directories.
  • Brute-force is the act of trying every possibility until a match is found. It is like having ten keys and trying them all on a lock until one fits. Gobuster uses wordlists for this purpose.

GoBuster Operation modes#

  dir   - Uses directory/file enumeration mode
  dns   -  Uses DNS subdomain enumeration mode
  fuzz  - Uses fuzzing mode. Replaces the keyword FUZZ in the URL, Headers and the request body
  vhost       Uses VHOST enumeration mode (you most probably want to use the IP address as the URL parameter)
  gcs   - Uses gcs bucket enumeration mode
  s3    - Uses aws bucket enumeration mode

Directory Enumeration#

  • Directory enumeration, with 64 threads
    gobuster dir -u "http://www.example.thm/" -w /usr/share/wordlists/dirb/small.txt -t 64

  • We have get little deep information with gobuster dir --help

  • for example, To configure Gobuster to follow the redirect responses received from the sent requests, we can use -r. lets say if a status code 301 was received, Gobuster will navigate to the redirect URL that is included in the response.
    gobuster dir -u "http://www.example.thm" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -r

  • Let’s look at a second example where we use the -x flag to specify what type of files we want to enumerate:
    gobuster dir -u "http://www.example.thm" -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x .php,.js

Subdomain Enumeration ( also called as dns mode)#

  • This mode allows Gobuster to brute force subdomains
  • To run Gobuster in dns mode, use the following command syntax (-d domain_name, -w wordlist):
    gobuster dns -d example.thm -w /path/to/wordlist

Vhost Enumeration (vhost mode.)#

  • This mode allows Gobuster to brute force virtual hosts. Virtual hosts are different websites on the same machine. Sometimes, they look like subdomains, but don’t be deceived! Virtual hosts are IP-based and are running on the same server. Subdomains are set up in DNS. The difference between vhost and dns mode is in the way Gobuster scans:
  • vhost mode will navigate to the URL created by combining the configured HOSTNAME (-u flag) with an entry of a wordlist.
  • dns mode will do a DNS lookup to the FQDN created by combining the configured domain name (-d flag) with an entry of a wordlist.
  • To run Gobuster in vhost mode, type the following command:
    gobuster vhost -u "http://example.thm" -w /path/to/wordlist