gobuster
Fast Go-based directory, DNS, and virtual host brute forcer with multiple modes for web application attack surface discovery.
Technical Architecture & Overview
gobuster is a Go-based directory, DNS, and virtual host brute forcer. It tests web paths, subdomains, and virtual hosts with wordlists and a small set of HTTP and DNS modes. The tool has wildcard detection, custom headers, and extension-based file searches.
Targeted Technical Use Cases
Use gobuster to map hidden directories, enumerate subdomains, and audit virtual host routing on web applications.
Evaluation & Trade-offs
Core Strengths
- +Runs multi-threaded scans with configurable concurrency.
- +Supports multiple modes: directory, DNS, vhost, S3 bucket, GCS bucket, TFTP, and fuzzing.
- +Supports custom headers, cookies, basic authentication, and proxies for authenticated scans.
Trade-Offs & Limitations
- -Each HTTP mode run targets a single base URL.
- -Directory mode stops with a wildcard error when non-existent paths return matching responses, until the response length or status code is excluded.
Defensive Security Application
Use gobuster during web audits to find hidden directories and misconfigured virtual hosts, then remove or restrict unintended public access.
Frequently Asked Questions
What is gobuster?→
gobuster is a Go-based directory, DNS, and virtual host brute forcer. It tests web paths, subdomains, and virtual hosts with wordlists and a small set of HTTP and DNS modes. The tool has wildcard detection, custom headers, and extension-based file searches.
What is gobuster used for?→
Use gobuster to map hidden directories, enumerate subdomains, and audit virtual host routing on web applications.
What are the strengths of gobuster?→
- +Runs multi-threaded scans with configurable concurrency.
- +Supports multiple modes: directory, DNS, vhost, S3 bucket, GCS bucket, TFTP, and fuzzing.
- +Supports custom headers, cookies, basic authentication, and proxies for authenticated scans.
What are the limitations of gobuster?→
- +Each HTTP mode run targets a single base URL.
- +Directory mode stops with a wildcard error when non-existent paths return matching responses, until the response length or status code is excluded.
How is gobuster used defensively?→
Use gobuster during web audits to find hidden directories and misconfigured virtual hosts, then remove or restrict unintended public access.