Gobuster in Practice: 20 Commands for Directory and DNS Enumeration

Gobuster is a powerful, fast enumeration tool that operates on the Go programming language. It is designed to discover hidden directories, files, DNS subdomains, virtual hosts, and cloud storage buckets through brute-force methods. Its speed is attributed to concurrent threading, and its straightforward nature makes it an essential tool during the reconnaissance phase of web application assessments. This guide presents twenty practical Gobuster commands, detailing their function and appropriate use cases.

The dir mode of Gobuster is used for enumerating directories and files on a web server. The -u flag specifies the target URL, while the -w flag points to the wordlist containing potential entries. This command serves as the foundation for many web content discoveries. Including file extensions via the -x flag expands the search to specific file types, uncovering backup files, configuration files, and script files that might be overlooked during directory-only enumeration.

Customizing the status codes that Gobuster considers valid findings is possible with the -s flag. By default, Gobuster looks for status codes such as 200, 204, 301, 302, 307, 401, and 403. Adjusting this list can help filter out noise from applications with unusual response patterns. Conversely, the -b flag allows excluding specific status codes from the results, which can be useful when a server consistently returns 403 errors, potentially indicating a false positive.

Customizing the User-Agent string via the -a flag enables Gobuster to mimic a specific browser. This can help bypass basic filtering that targets default tool User-Agents. Adding cookies for authenticated scanning with the -c flag allows for the enumeration of content behind authentication, provided a valid session token is already present. Custom headers can be added using the -H flag, which is beneficial for testing header-based access controls, bypassing IP restrictions, or simulating requests from a reverse proxy.

Following HTTP redirects is facilitated by the -r flag. This ensures that when a server returns a 301 or 302 redirect, Gobuster can confirm the existence of the resource at the new location or determine if it leads to a dead end. Controlling the thread count with the -t flag allows for faster enumeration at the expense of increased load on the target and the possibility of triggering rate limiting or WAF blocks.

Adjusting the request timeout with the --timeout flag accommodates slow applications, balancing between a slower scan and a quicker assessment of responsive targets.

Verbose mode, activated with the -v flag, provides additional details such as response lengths and redirect targets, assisting in distinguishing true findings from soft 404 pages that return a 200 status code. Suppressing output with the -q flag streamlines the process, showing only results which is particularly useful for scripting or when feeding output into other tools. Saving results to a file using the -o flag maintains a record of enumeration results, preserving an audit trail and preventing redundant work.

Expanding the search to include DNS subdomains is achieved using the dns mode of Gobuster, which queries DNS resolvers. The -d flag specifies the target domain, revealing additional attack surfaces such as development, staging, and administrative subdomains. Displaying CNAME records with the -c flag alongside A records offers insights into cloud services, CDNs, and third-party integrations that broaden the scope of potential vulnerabilities.