Gobuster Section 9 of 13

Usage Examples

Real-world Gobuster commands organized by mode. Each example includes the command, a detailed explanation, and guidance on when to use it.

Directory Scanning

Directory scan with extensions

bash

1gobuster dir -u http://10.0.0.1/ -w /usr/share/wordlists/dirb/common.txt -x php,txt,html,js

Scans for directories and files, appending common web extensions to each wordlist entry. Essential for PHP-based applications.

Dir scan with authentication cookie

bash

1gobuster dir -u http://10.0.0.1/ -w common.txt -c "session=abc123"

Adds a session cookie to each request, allowing you to scan authenticated areas of a web application.

Directory scan with custom headers

bash

1gobuster dir -u http://10.0.0.1/ -w common.txt -H "Authorization: Bearer token" -H "X-API-Key: key123"

Adds multiple custom headers. Useful for API endpoints that require authentication tokens or API keys.

Follow redirects during dir scan

bash

1gobuster dir -u http://10.0.0.1/ -w common.txt -r

Follows HTTP redirects to their final destination. Some resources return 301/302 but are actually accessible after redirect.

Save output to file

bash

1gobuster dir -u http://10.0.0.1/ -w common.txt -o results.txt

Saves all discovered directories and files to a text file for later analysis and reporting.

DNS Subdomain Enumeration

DNS subdomain enumeration

bash

1gobuster dns -d example.com -w /usr/share/wordlists/subdomains-top1million-5000.txt

Enumerates subdomains using a list of 5,000 common subdomains. Fast and effective for initial reconnaissance.

DNS with IP display

bash

1gobuster dns -d example.com -w subdomains.txt -i

Shows the resolved IP address for each discovered subdomain. Helps identify cloud providers and infrastructure.

Virtual Host Discovery

Virtual host discovery

bash

1gobuster vhost -u http://10.0.0.1/ -w /usr/share/wordlists/vhosts.txt

Tests different Host headers against an IP address to discover virtual hosts on shared hosting.

Vhost with domain append

bash

1gobuster vhost -u http://10.0.0.1/ -w common.txt --append-domain -d example.com

Automatically appends .example.com to each wordlist entry. Saves time when building subdomain-style vhosts.

S3 Bucket Enumeration

S3 bucket enumeration

bash

1gobuster s3 -w /usr/share/wordlists/s3-buckets.txt

Brute forces S3 bucket names to find publicly exposed buckets with misconfigured permissions.

Generic Fuzzing

Fuzz URL paths with threads

bash

1gobuster fuzz -u "http://10.0.0.1/FUZZ" -w /usr/share/wordlists/common.txt -t 50

Fuzzes URL paths with increased thread count for faster enumeration. The FUZZ keyword is replaced with each wordlist entry.

Fuzz with POST data

bash

1gobuster fuzz -u "http://10.0.0.1/login" -w passwords.txt -d "username=admin&password=FUZZ" -X POST

Fuzzes the password field in a POST login request. Useful for testing credential strength against known passwords.

Important

All examples assume you have written authorization to test the target. Never run brute-force tools against networks or applications you do not own without explicit permission.

Next: Command Builder Back