Gobuster

Gobuster is a command-line brute-forcing tool written in Go for security professionals and penetration testers. It takes a wordlist and tests each entry against a target to find hidden content. It runs multi-threaded with configurable concurrency (-t).

It uses a mode-based interface: gobuster [mode] [options]. The modes are dir (web directories and files), dns (subdomains), vhost (virtual hosts), s3 and gcs (Amazon S3 and Google Cloud Storage buckets), tftp (files on TFTP servers) and fuzz (custom fuzzing using the FUZZ keyword). gobuster help [mode] shows the options for each mode.

Mode-specific options include file extensions (-x php,html,js), custom headers and cookies (-H, -c), and status code filtering (-s 200,301,302). The DNS mode accepts a custom resolver (-r 8.8.8.8:53). Fuzz mode can substitute FUZZ into URL parameters, headers, or POST data. Results can be written to a file with -o, and -q gives quieter output. Flags such as --delay and --timeout help with rate-limited or slow targets. The changelog also lists TLS client certificates, proxies, and selecting the outgoing network interface.

Typical users are pentesters and security researchers doing web application testing, DNS reconnaissance, or cloud storage assessments, usually with wordlists such as SecLists. The README stresses having authorization before testing any target.

Installation

# via Go
go install github.com/OJ/gobuster/v3@latest

# via Docker
docker pull ghcr.io/oj/gobuster:latest

# via Source
git clone https://github.com/OJ/gobuster.git
cd gobuster
go mod tidy
go build