gobuster README

The project's README from github.com/OJ/gobuster. As one markdown file: README.md.

Gobuster

Go Report Card License Backers on Open Collective Sponsors on Open Collective

💻 Introduction

A fast and flexible brute-forcing tool written in Go

Gobuster is a high-performance directory/file, DNS and virtual host brute-forcing tool written in Go. It's designed to be fast, reliable, and easy to use for security professionals and penetration testers.

✨ Features

🎯 What Can Gobuster Do?

🚀 Quick Start

# Install gobuster
go install github.com/OJ/gobuster/v3@latest

# Basic directory enumeration
gobuster dir -u https://example.com -w /path/to/wordlist.txt

# DNS subdomain enumeration
gobuster dns -do example.com -w /path/to/wordlist.txt

# Virtual host discovery
gobuster vhost -u https://example.com -w /path/to/wordlist.txt

# S3 bucket enumeration
gobuster s3 -w /path/to/bucket-names.txt

📦 Installation

go install github.com/OJ/gobuster/v3@latest

Requirements: Go 1.24 or higher

Alternative Installation Methods

Using Binary Releases

Download pre-compiled binaries from the releases page.

Using Docker

# Pull the latest image
docker pull ghcr.io/oj/gobuster:latest

# Run gobuster in Docker
docker run --rm -it ghcr.io/oj/gobuster:latest dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt

Building from Source

git clone https://github.com/OJ/gobuster.git
cd gobuster
go mod tidy
go build

Troubleshooting Installation

If you encounter issues:

🎯 Usage

Gobuster uses a mode-based approach. Each mode is designed for specific enumeration tasks:

gobuster [mode] [options]

Getting Help

gobuster help                   # Show general help
gobuster help [mode]            # Show help for specific mode
gobuster [mode] --help          # Alternative help syntax

📊 Available Modes

🌐 Directory Mode (dir)

Enumerate directories and files on web servers.

Basic Usage:

gobuster dir -u https://example.com -w wordlist.txt

Advanced Options:

# With file extensions
gobuster dir -u https://example.com -w wordlist.txt -x php,html,js,txt

# With custom headers and cookies
gobuster dir -u https://example.com -w wordlist.txt -H "Authorization: Bearer token" -c "session=value"

# Show response length
gobuster dir -u https://example.com -w wordlist.txt -l

# Filter by status codes
gobuster dir -u https://example.com -w wordlist.txt -s 200,301,302

🔍 DNS Mode (dns)

Discover subdomains through DNS resolution.

Basic Usage:

gobuster dns -do example.com -w wordlist.txt

Advanced Options:

# Use custom DNS server
gobuster dns -do example.com -w wordlist.txt -r 8.8.8.8:53

# Increase threads for faster scanning
gobuster dns -do example.com -w wordlist.txt -t 50

🏠 Virtual Host Mode (vhost)

Discover virtual hosts on web servers.

Basic Usage:

gobuster vhost -u https://example.com --append-domain -w wordlist.txt

☁️ S3 Mode (s3)

Enumerate Amazon S3 buckets.

Basic Usage:

gobuster s3 -w bucket-names.txt

With Debug Output:

gobuster s3 -w bucket-names.txt --debug

🖥️ TFTP Mode (tftp)

Enumerate files on tftp servers.

Basic Usage:

gobuster tftp -s 10.0.0.1 -w wordlist.txt

☁️ GCS Mode (gcs)

Enumerate Google Cloud Storage Buckets.

Basic Usage:

gobuster gcs -w bucket-names.txt

With Debug Output:

gobuster gcs -w bucket-names.txt --debug

🔧 Fuzz Mode (fuzz)

Custom fuzzing with the FUZZ keyword.

Basic Usage:

gobuster fuzz -u https://example.com?FUZZ=test -w wordlist.txt

Advanced Examples:

# Fuzz URL parameters
gobuster fuzz -u https://example.com?param=FUZZ -w wordlist.txt

# Fuzz headers
gobuster fuzz -u https://example.com -H "X-Custom-Header: FUZZ" -w wordlist.txt

# Fuzz POST data
gobuster fuzz -u https://example.com -d "username=admin&password=FUZZ" -w passwords.txt

💰 Support

Backers on Open Collective Sponsors on Open Collective

Love this tool? Back it!

If you're backing us already, you rock. If you're not, that's cool too! Want to back us? Become a backer!

Backers

All funds that are donated to this project will be donated to charity. A full log of charity donations will be available in this repository as they are processed.

💡 Common Use Cases

Web Application Security Testing

# Comprehensive directory enumeration
gobuster dir -u https://target.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,asp,aspx,jsp

# API endpoint discovery
gobuster dir -u https://api.target.com -w /usr/share/wordlists/dirb/common.txt -x json

# Admin panel discovery
gobuster dir -u https://target.com -w admin-panels.txt -s 200,301,302,403

DNS Reconnaissance

# Comprehensive subdomain enumeration
gobuster dns -do target.com -w /usr/share/wordlists/dnsrecon/subdomains-top1mil-5000.txt -t 50

Cloud Storage Assessment

# S3 bucket enumeration with patterns
gobuster s3 -w company-names.txt -v

# GCS bucket enumeration
gobuster gcs -w company-names.txt -v

🔧 Troubleshooting

Common Issues

"Permission Denied" or "Access Denied"

"Connection Timeout"

"No Results Found"

Performance Issues

Slow Scanning

🎯 Best Practices

Security Testing Guidelines

  1. Always get proper authorization before testing any target
  2. Start with low thread counts to avoid overwhelming servers
  3. Use appropriate wordlists for the target technology
  4. Respect rate limits and implement delays if needed
  5. Monitor your network traffic to avoid detection

Wordlist Selection

Output Management

# Save results to file
gobuster dir -u https://example.com -w wordlist.txt -o results.txt

# Use quiet mode for clean output
gobuster dir -u https://example.com -w wordlist.txt -q

📚 Additional Resources

Happy hacking! 🚀

Remember: Always test responsibly and with proper authorization.

Changes

3.8.2

3.8.2

  • Fix expanded mode to show the full url again
3.8.1

3.8.1

  • Fix expanded mode showing the entries twice
3.8

3.8

  • Add exclude-hostname-length flag to dynamically adjust exclude-length by @0xyy66
  • Fix Fuzzing query parameters
  • Add --force flag in dir mode to continue execution if precheck errors occur
3.7

3.7

  • use new cli library
  • a lot more short options due to the new cli library
  • more user friendly error messages
  • clean up DNS mode
  • renamed show-cname to check-cname in dns mode
  • got rid of verbose flag and introduced debug instead
  • the version command now also shows some build variables for more info
  • switched to another pkcs12 library to support p12s generated with openssl3 that use SHA256 HMAC
  • comments in wordlists (strings starting with #) are no longer ignored
  • warn in vhost mode if the --append-domain switch might have been forgotten
  • allow to exclude status code and length in vhost mode
  • added automaxprocs for use in docker with cpu limits
  • log http requests with debug enabled
  • allow fuzzing of Host header in fuzz mode
  • automatically disable progress output when output is redirected
  • fix extra special characters when run with --no-progress
  • warn when using vhost mode with a proxy and http based urls as this might not work as expected
  • add interface and local-ip parameters to specify the outgoing interface for http requests
  • add support for tls renegotiation
  • fix progress with patterns by @acammack
  • fix backup discovery by @acammack
  • support tcp protocol on dns servers
  • add support for URL query parameters
3.6

3.6

  • Wordlist offset parameter to skip x lines from the wordlist
  • prevent double slashes when building up an url in dir mode
  • allow for multiple values and ranges on --exclude-length
  • no-fqdn parameter on dns bruteforce to disable the use of the systems search domains. This should speed up the run if you have configured some search domains. https://github.com/OJ/gobuster/pull/418
3.5

3.5

  • Allow Ranges in status code and status code blacklist. Example: 200,300-305,404
3.4

3.4

  • Enable TLS1.0 and TLS1.1 support
  • Add TFTP mode to search for files on tftp servers
3.3

3.3

  • Support TLS client certificates / mtls
  • support loading extensions from file
  • support fuzzing POST body, HTTP headers and basic auth
  • new option to not canonicalize header names
3.2

3.2

  • Use go 1.19
  • use contexts in the correct way
  • get rid of the wildcard flag (except in DNS mode)
  • color output
  • retry on timeout
  • google cloud bucket enumeration
  • fix nil reference errors
3.1

3.1

  • enumerate public AWS S3 buckets
  • fuzzing mode
  • specify HTTP method
  • added support for patterns. You can now specify a file containing patterns that are applied to every word, one by line. Every occurrence of the term {GOBUSTER} in it will be replaced with the current wordlist item. Please use with caution as this can cause increase the number of requests issued a lot.
  • The shorthand p flag which was assigned to proxy is now used by the pattern flag
3.0

3.0

  • New CLI options so modes are strictly separated (-m is now gone!)
  • Performance Optimizations and better connection handling
  • Ability to enumerate vhost names
  • Option to supply custom HTTP headers

gobuster (OJ/gobuster)

Searching Database…

14.2K ·GitHub
Gobuster
这是什么？Gobuster 是一个用 Go 编写的快速多线程命令行工具，用于暴力枚举网站目录和文件、DNS 子域名以及虚拟主机，还可以枚举 S3/GCS 云存储桶和 TFTP 文件。
这是图形界面程序还是命令行工具？它是纯命令行工具，采用基于模式的界面：你选择一种模式（如 dir、dns、vhost、s3、gcs、tftp 或 fuzz），再加上参数运行即可。
怎么安装和运行？你可以通过 Quick Install 方法使用 Go 1.24+ 安装，也可以从发布页面下载预编译的二进制文件，拉取 Docker 镜像，或者从源代码编译。
编译它需要先安装 Go 吗？只有从源代码安装或使用 'go install' 时才需要，此时要求 Go 1.24 或更高版本；二进制发布版和 Docker 镜像完全不需要 Go。
扫描目标前需要获得许可吗？需要。README 明确提醒，在测试任何目标之前都必须获得正式授权，因为暴力枚举会产生大量流量，可能触发速率限制或被检测到。
它能在 Windows 和 macOS 上运行吗，还是只能用于 Linux？作为 Go 二进制程序，它可以跨平台运行于 Linux、macOS 和 Windows 上，同时还提供官方 Docker 镜像。
Gobuster 支持哪些模式？它支持 dir、dns、vhost、s3、gcs、tftp 和 fuzz 模式，分别用于目录和文件枚举、子域名发现、虚拟主机检测、云存储桶枚举、TFTP 文件发现以及自定义 FUZZ 关键字模糊测试。
它能找到公开的 S3 或 Google Cloud Storage 存储桶吗？可以。s3 和 gcs 模式分别可以用来枚举公开的 Amazon S3 和 Google Cloud Storage 存储桶。
它支持自定义字典和模式吗？支持。你可以提供自己的字典，还可以选择应用一个模式文件，其中每个 '{GOBUSTER}' 占位符都会被替换为当前字典中的条目。
What are similar projects?bbot, theHarvester, OneForAll, ffuf, masscan, thc-hydra, Sublist3r, nikto
Which topics is it in?brute-force, subdomain-enumeration, fuzzing, scanner, reconnaissance, network, hacking-tool, dns, aws, pentesting, cybersecurity, security-tools
Creator
OJ
Size
1.3 MB
Stars
14.2K
Updated
CommitJan 13Releasev3.8.2Sep 04
Age
11y
Commits · 90 Days