# Gobuster

> Go-based brute-forcing tool for web directories/files, DNS subdomains, virtual hosts, S3/GCS buckets, TFTP files, and custom fuzzing.

Stars: 14.3k · Language: Go · License: Apache-2.0 · Categories: Network

- Repository: https://github.com/OJ/gobuster
- Page: https://www.trmn.sh/tools/gobuster

## Install

- Go: `go install github.com/OJ/gobuster/v3@latest`
- Docker: `docker pull ghcr.io/oj/gobuster:latest`
- Source: `git clone https://github.com/OJ/gobuster.git`
- Source: `cd gobuster`
- Source: `go mod tidy`
- Source: `go build`

## Overview

Gobuster is a command-line brute-forcing tool written in Go for security professionals and penetration testers. It takes a wordlist and tests each entry against a target to find hidden content. It runs multi-threaded with configurable concurrency (`-t`).

It uses a mode-based interface: `gobuster [mode] [options]`. The modes are `dir` (web directories and files), `dns` (subdomains), `vhost` (virtual hosts), `s3` and `gcs` (Amazon S3 and Google Cloud Storage buckets), `tftp` (files on TFTP servers) and `fuzz` (custom fuzzing using the `FUZZ` keyword). `gobuster help [mode]` shows the options for each mode.

Mode-specific options include file extensions (`-x php,html,js`), custom headers and cookies (`-H`, `-c`), and status code filtering (`-s 200,301,302`). The DNS mode accepts a custom resolver (`-r 8.8.8.8:53`). Fuzz mode can substitute `FUZZ` into URL parameters, headers, or POST data. Results can be written to a file with `-o`, and `-q` gives quieter output. Flags such as `--delay` and `--timeout` help with rate-limited or slow targets. The changelog also lists TLS client certificates, proxies, and selecting the outgoing network interface.

Typical users are pentesters and security researchers doing web application testing, DNS reconnaissance, or cloud storage assessments, usually with wordlists such as SecLists. The README stresses having authorization before testing any target.

### Installation

```bash
# via Go
go install github.com/OJ/gobuster/v3@latest
```

```bash
# via Docker
docker pull ghcr.io/oj/gobuster:latest
```

```bash
# via Source
git clone https://github.com/OJ/gobuster.git
cd gobuster
go mod tidy
go build
```

## Alternatives

- [subfinder](https://www.trmn.sh/tools/subfinder.md): Passive subdomain enumeration tool written in Go that queries online sources, with JSON output, wildcard elimination, and STDIN/STDOUT support. (Go, 14.7k stars)
- [katana](https://www.trmn.sh/tools/katana.md): Go-based web crawler from ProjectDiscovery with standard and headless Chrome modes, JavaScript endpoint parsing, scope control, and JSON output for pipelines. (Go, 17.8k stars)
- [wuzz](https://www.trmn.sh/tools/wuzz.md): Interactive terminal UI for inspecting and editing HTTP requests and responses, with cURL-style arguments and regex, HTML and JSON response filtering. (Go, 10.7k stars)
- [httpx](https://www.trmn.sh/tools/httpx.md): HTTP probing CLI from ProjectDiscovery that takes hosts, URLs or CIDRs and reports status, title, TLS, tech stack, CDN and more, with matchers and filters. (Go, 10.6k stars)
- [qrcp](https://www.trmn.sh/tools/qrcp.md): Go CLI that transfers files between a computer and a mobile device over Wi-Fi by printing a QR code in the terminal that links to a temporary local web server. (Go, 10.5k stars)

---

Canonical: https://www.trmn.sh/tools/gobuster