Pro Tips
Expert guidance for getting the most out of Gobuster while avoiding common mistakes. These tips cover speed, stealth, accuracy, and responsible disclosure.
Expert Recommendations
Gobuster is Loud — Get Authorization
Gobuster sends hundreds or thousands of HTTP requests in rapid succession. This is easily detected by WAFs, IDS systems, and server logs. Always obtain explicit written authorization before brute-forcing any target.
1gobuster dir -u http://10.0.0.1/ -w common.txt -t 10
Use -t 50+ on Fast Networks
On reliable, high-speed networks, increasing threads dramatically speeds up enumeration. Start with -t 10, then increase to -t 50 or -t 100 if the target handles it without errors.
1gobuster dir -u http://10.0.0.1/ -w common.txt -t 50
Combine Gobuster with Other Tools
Gobuster excels at speed but lacks advanced filtering. Combine it with ffuf or feroxbuster for more sophisticated response filtering, or use httpx to quickly probe discovered endpoints for alive services.
1gobuster dns -d example.com -w subdomains.txt -o subs.txt && cat subs.txt | httpx
Always Use Extensions on Web Apps
A basic directory scan without -x will miss critical files like config.php, backup.zip, or database.sql. Always include relevant extensions for the target technology stack.
1gobuster dir -u http://10.0.0.1/ -w common.txt -x php,txt,bak,zip,sql,js,html
Filter Wildcard Responses
Some servers return the same response for every request (wildcard responses). Without filtering, Gobuster reports every word as a hit. Use --exclude-length or --wildcard to handle this.
1gobuster dir -u http://10.0.0.1/ -w common.txt --exclude-length 1234
Use -k for Self-Signed HTTPS
When scanning HTTPS sites with self-signed or invalid certificates, Gobuster will error out unless you use -k to skip TLS verification.
1gobuster dir -u https://10.0.0.1/ -w common.txt -k
Save Results Every Time
Always use -o to save results. Command-line output is easily lost. Saved files are essential for reporting, comparison between scans, and feeding data into other tools.
1gobuster dir -u http://10.0.0.1/ -w common.txt -o results.txt
Use Custom Wordlists for Targets
Generic wordlists find generic results. Build target-specific lists from OSINT: company names, product names, employee names, industry terms. These often reveal admin panels, dev environments, and backup endpoints.
1gobuster dir -u http://10.0.0.1/ -w custom-target.txt -x php
Authenticate for Deeper Coverage
Many applications hide endpoints behind authentication. Use -c for cookies or -H for tokens to scan authenticated areas that unauthenticated scanners completely miss.
1gobuster dir -u http://10.0.0.1/ -w common.txt -c "session=abc123"
Watch for Rate Limiting
If Gobuster starts receiving 429 (Too Many Requests) or connection timeouts, the target has rate limiting. Reduce threads with -t 5 or add --delay 1s to stay under the limit.
1gobuster dir -u http://10.0.0.1/ -w common.txt -t 5 --delay 1s
Enumerate S3 Buckets Systematically
When searching for S3 buckets, try common naming patterns: company-backup, company-dev, company-staging, app-name-data. Also try common region suffixes if you know the AWS region.
1gobuster s3 -w s3-buckets.txt
Combine DNS and Vhost Enumeration
First find subdomains with Gobuster DNS, then check if multiple subdomains resolve to the same IP. If they do, use vhost mode to discover additional virtual hosts on that shared infrastructure.
1gobuster dns -d example.com -w subdomains.txt && gobuster vhost -u http://10.0.0.1/ -w vhosts.txt --append-domain -d example.com
Legal & Ethical Considerations
Important
Rules of Engagement
- Never brute-force targets outside your authorized scope
- Respect rate limits and reduce threads if the target shows signs of stress
- Do not download files from discovered S3 buckets without permission
- Report findings responsibly and do not exploit them without authorization
- Delete scan data when the engagement concludes per your agreement