Gobuster
Gobusteris a fast, multi-threaded tool written in Go for brute forcing URIs, DNS subdomains, virtual hosts, AWS S3 buckets, and generic HTTP fuzzing. It is significantly faster than Python-based alternatives due to Go's concurrency model.
Module Sections
Directory & File Bruteforce
Discover hidden directories and files on web servers by trying a wordlist against a URL.
DNS Subdomain Bruteforce
Discover subdomains by DNS resolution using a wordlist. Great for reconnaissance.
Virtual Host Bruteforce
Test different Host headers to discover virtual hosts on shared hosting environments.
AWS S3 Bucket Enumeration
Brute force S3 bucket names to find publicly exposed buckets with misconfigured permissions.
Generic Fuzzing
Fuzz any part of an HTTP request using placeholders. Powerful and flexible.
Common Flags
Comprehensive reference of every Gobuster flag with real-world usage examples.
Wordlists
Recommended wordlists from Kali, SecLists, and custom sources for each Gobuster mode.
Installation
Install Gobuster on Linux, macOS, Windows, Docker, and from source.
Usage Examples
Real-world commands for each Gobuster mode with context and best practices.
Command Builder
Interactive tool to select mode, configure options, and generate Gobuster commands.
Pro Tips
Expert advice on rate limiting, wordlist selection, output management, and stealth.
Gobuster Quiz
Test your knowledge with 17 multiple-choice questions covering all Gobuster concepts.
Gobuster Lab
Hands-on exercises where you type real Gobuster commands for different scenarios.
Quick Start
New to Gobuster? Start with these three sections in order: