Gobuster
Gobuster brute-forces URIs (directories and files), DNS subdomains and virtual host names using wordlists.
Legal & ethical use. Use this tool only on systems, networks and data that you own or have explicit written permission to test. Unauthorised access or scanning can break computer-misuse laws (for example Pakistan's Prevention of Electronic Crimes Act, 2016, and equivalents elsewhere). Practise in your own lab or in authorised environments such as CTFs.
What it is used for
- Enumerate paths on a CTF or lab web server
- Brute-force subdomains of a domain you own
Key features
- dir, dns, vhost and other modes
- Concurrency control
- Pattern and extension options
Installation
Install a release binary or use your distribution package.
Beginner usage guide
Pick a mode (dir for web paths), provide a wordlist, and review status codes; pair it with manual browsing to confirm findings.
Example commands
Run these only against your own lab or authorised targets. Placeholder addresses such as 192.0.2.x are documentation ranges.
Directory mode
gobuster dir -u http://127.0.0.1:8081 -w /usr/share/wordlists/dirb/common.txtTries each word as a path under the target URL and lists those that exist.
References
Source verification
Last reviewed: 2026-10-27
Links checked over HTTP: 2026-10-27 07:51 UTC — official: 200, docs: 200, repo: 200
Command flags checked against the real binary gobuster (No help topic for 'version') on 2026-10-27.