gobuster

Gobuster ([github.com/OJ/gobusterGitHub — OJ/gobuster) is a fast, multi-threaded brute-forcing tool written in Go, used primarily during the reconnaissance phase of an assessment to enumerate directories/files on web servers, DNS subdomains, and virtual hosts. Because it is compiled and uses configurable goroutine-based concurrency, it is dramatically faster than interpreted equivalents — raising the thread count (-t) is the single biggest performance lever, at the cost of being noisier on the wire.

Modes

Gobuster is mode-based: gobuster <mode> [options]. Use gobuster help for general help and gobuster <mode> --help for mode-specific flags.

Mode	Purpose
dir	Directory and file enumeration on web servers
dns	DNS subdomain brute-forcing (with wildcard detection)
vhost	Virtual host discovery on a target web server
s3	Open Amazon S3 bucket enumeration
gcs	Google Cloud Storage bucket enumeration
tftp	File discovery on TFTP servers
fuzz	Generic fuzzing (replace the FUZZ keyword, wfuzz-style)

Typical invocations

# Directory/file enumeration
gobuster dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt -t 50
 
# Subdomain enumeration
gobuster dns -do example.com -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt
 
# Virtual host discovery
gobuster vhost -u https://example.com -w vhosts.txt --append-domain

Useful flags: -x (file extensions to append in dir mode), -k (skip TLS verification), -s/-b (status code allow/deny lists), -o (output file), --no-error (suppress connection errors).

Installation

go install github.com/OJ/gobuster/v3@latest   # requires Go 1.24+
# or: docker pull ghcr.io/oj/gobuster:latest

Related tools

• wfuzz — payload-position web fuzzer; similar FUZZ keyword model, far richer filtering/encoders
• ffuf — Go-based general web fuzzer with the same FUZZ model; faster, now the more common choice
• dirbuster — the older Java/OWASP GUI brute-forcer; gobuster largely replaced it, but its directory-list-2.3-* wordlists remain the standard input
• dirb — lightweight C-based web content scanner; simpler than gobuster, good for quick checks
• turbo-intruder — Burp-based, optimized for extreme request rates
• owasp-zap — GUI proxy with a gobuster-like Forced Browse mode
• nmap — port/service discovery that precedes content brute-forcing

Sources

• GitHub — OJ/gobuster