room ~ Gobuster - Directory Brute Forcer
Gobuster - Directory Brute Forcer
Directory enumeration, subdomain scanning, wordlists, and web content discovery
1/4
lessons
What is Gobuster?
Purpose
- Gobuster = web content discovery tool
- Brute forces directories, files, subdomains, and virtual hosts
- Uses wordlists — tries each word as a path on the target
- Fast (written in Go, multi-threaded)
What It Finds
| Mode | Discovers | Example |
|---|---|---|
| dir | Directories & files | /admin, /backup, /config.php |
| dns | Subdomains | dev.target.com, staging.target.com |
| vhost | Virtual hosts | Internal sites on same IP |
Key Concept: Wordlists
- Gobuster does NOT guess or crawl
- It takes a wordlist (text file with one word per line) and tries each
- Quality of results depends on wordlist quality
- Bigger wordlist = more thorough but slower
Common Wordlists (Kali Linux)
/usr/share/wordlists/dirb/common.txt (4,600 words — quick)
/usr/share/wordlists/dirb/big.txt (20,400 words — thorough)
/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt (220,000 — comprehensive)
/usr/share/seclists/Discovery/Web-Content/ (many specialized lists)
When to Use Gobuster
- After finding a web server (port 80/443 open)
- Want to find hidden pages/directories
- Looking for admin panels, backup files, config files
- Subdomain enumeration for larger scope
Gobuster vs Alternatives
| Tool | Speed | Features |
|---|---|---|
| Gobuster | Fast (Go) | dir, dns, vhost |
| dirb | Slow | Simple, recursive |
| dirbuster | Medium (Java GUI) | Recursive, GUI |
| ffuf | Very fast | Flexible fuzzer |
| feroxbuster | Fast (Rust) | Auto-recursive |