Directory & File Bruteforce
The dirmode is Gobuster's original and most widely used feature. It discovers hidden directories, files, and endpoints on web servers by systematically testing a wordlist against a target URL.
How Directory Scanning Works
Gobuster takes each word from your wordlist and appends it to the target URL, sending an HTTP GET request for each combination. If the server responds with anything other than a 404 status code, Gobuster reports it as a potential finding. This simple but effective approach reveals admin panels, backup files, configuration files, API endpoints, and hidden application routes.
Scanning Flow
Gobuster parses the target URL, validates it, and prepares the base path for wordlist appending.
The wordlist is loaded into memory. Large wordlists (millions of entries) are handled efficiently in Go.
Gobuster spawns multiple goroutines (threads) to send HTTP requests in parallel. Default is 10 threads.
Each response is checked for status codes, body length, and redirect behavior. Non-404 responses are reported.
Results are printed to stdout in real-time and optionally saved to a file with -o.
Directory Scanning Techniques
Basic Directory Scan
The simplest directory scan uses a wordlist to guess common directory and file names. Gobuster sends HTTP GET requests and reports any response that does not return a 404 status code.
1gobuster dir -u http://10.0.0.1/ -w /usr/share/wordlists/dirb/common.txt
Scan with Extensions
Web applications often hide backend files like .php, .bak, .txt, or .zip. The -x flag appends extensions to each wordlist entry, dramatically increasing coverage.
1gobuster dir -u http://10.0.0.1/ -w /usr/share/wordlists/dirb/common.txt -x php,txt,html,js,bak,zip
Follow Redirects
By default, Gobuster does not follow HTTP redirects. A 301/302 response might lead to an accessible resource. Use -r to follow redirects and see the final destination.
1gobuster dir -u http://10.0.0.1/ -w common.txt -r
Authenticated Scanning
Many admin panels and APIs require authentication. Use -c to add a session cookie or -H to add custom headers like Authorization tokens.
1gobuster dir -u http://10.0.0.1/ -w common.txt -c "session=abc123"
Custom Status Codes
Gobuster reports any status code that is not 404 by default. You can explicitly include or exclude codes to filter noise. Use --exclude-length to hide responses with known false-positive lengths.
1gobuster dir -u http://10.0.0.1/ -w common.txt --exclude-length 1234
Recursive Scanning
When Gobuster finds a directory, you can recursively scan deeper paths. Combine with -t to increase thread count for faster deep enumeration.
1gobuster dir -u http://10.0.0.1/admin/ -w common.txt -t 50
Understanding HTTP Status Codes
Reading Gobuster output correctly means understanding what each HTTP status code tells you about the target resource.
| Status Code | Meaning | Recommended Action |
|---|---|---|
| 200 OK | Resource exists and is accessible. | Investigate — this is a valid file or directory. |
| 301/302 Redirect | Resource exists but redirects elsewhere. | Follow with -r or manually inspect the Location header. |
| 401 Unauthorized | Resource exists but requires authentication. | Try default credentials or credential stuffing attacks. |
| 403 Forbidden | Resource exists but access is denied. | Try bypass techniques like path traversal or method switching. |
| 404 Not Found | Resource does not exist (Gobuster filters these by default). | No action needed — this is what Gobuster expects for missing resources. |
| 500 Server Error | The server encountered an error processing the request. | May indicate a bug or unhandled input — try fuzzing the path. |
Pro Tips for Directory Scanning
Tip
-x with common extensions. A file named backup.sql will not be found unless you include sql in your extension list.Warning
-t 100) can trigger WAF rate limiting. Start with -t 10 and increase gradually if the target handles it well.Info
--wildcard to detect wildcard responses. Some servers return 200 for every request, making the scan useless without filtering.