Follow redirects instead of just reporting the 3xx.
-H 'Header: value'
Add a custom header (repeatable) — e.g. auth tokens, X-Forwarded-For.
-c '<cookie>'
Send cookies, e.g. for brute-forcing behind an authenticated session.
-U/-P
Username/password for HTTP Basic Auth.
-a / --random-agent
Set a specific User-Agent, or rotate a random one per request.
--proxy <url>
Route through http(s):// or socks5:// — point at Burp for visibility into what’s firing.
--retry / --retry-attempts
Auto-retry on timeout instead of silently dropping a guess.
-p <file> / --pattern
A pattern file for wordlist-side substitutions (see Tips).
dir Mode — Directory/File Brute-Forcing
Flag
Description
-u <url>
Target URL.
-x php,html,txt,bak
Append these extensions to every wordlist entry — critical, gobuster does not guess extensions on its own.
-X <file>
Read the extension list from a file instead of inline.
-s 200,301,302 / -b 404
Whitelist (-s) or blacklist (-b) status codes; supports ranges like 300-400.
-e
Expanded mode — print full URLs instead of just the path (easier to pipe/click).
-f
Append / to every request — useful for finding directories specifically.
--discover-backup
On a hit, also probe common backup-file variants (file.php~, .bak, .old, etc.) — great for CTFs.
--exclude-length <n>
Hide results with a specific response body length — kills noisy “soft 404” pages that always return 200.
-m <method>
HTTP method to use (default GET) — e.g. -m HEAD for speed, or -m POST.
# Baseline directory brute-forcegobuster dir -u <target_URL> -w ~/Downloads/SecLists/Discovery/Web-Content/raft-small-directories-lowercase.txt# Search for specific file extensionsgobuster dir -u <target_URL> -w ~/Downloads/SecLists/Discovery/Web-Content/raft-small-directories-lowercase.txt -x php,html,txt,bak# Filter out a noisy "soft 404" page that always returns 200 with the same body lengthgobuster dir -u <target_URL> -w <wordlist> --exclude-length 1234# Speed upgobuster dir -u <target_URL> -w <wordlist> -t 50# Quiet mode, pipe to a filegobuster dir -u <target_URL> -w <wordlist> -q > found_dirs.txt# Self-signed/expired certgobuster dir -u <target_URL> -w <wordlist> -k
dns Mode — Subdomain Enumeration
Flag
Description
-d <domain>
Target domain (note: -d here, not -u — unlike every other mode).
-c
Also resolve and report CNAME records, not just A/AAAA.
--wildcard
Force gobuster to keep running even when wildcard DNS is detected (otherwise it aborts to avoid false positives).
-r <server[:port]>
Query a specific DNS resolver instead of the system default — useful when the target uses an internal DNS server.
gobuster dns -d example.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
vhost Mode — Virtual Host Enumeration
Flag
Description
-u <url>
Target — use the IP address, not a hostname, so you’re not just re-resolving the same vhost every time.
--append-domain
Append the base domain to each wordlist word to build the Host: header, e.g. admin → admin.example.com.
-c
Compare response length/behavior automatically to filter false positives from a catch-all vhost.
Use when the injection point isn’t a plain URL path — a query param, header value, POST body, or even a subdomain.
Flag
Description
-u <url>
Target URL containing the literal FUZZ keyword, e.g. http://target/?id=FUZZ.
-H 'Header: FUZZ'
Put FUZZ inside a header instead — e.g. brute-forcing an X-API-Key or Host: header.
-b '{"user":"FUZZ"}'
Put FUZZ inside the request body (needs -m POST).
# Fuzz a GET parameter valuegobuster fuzz -u 'http://target/search?q=FUZZ' -w <wordlist># Fuzz a request headergobuster fuzz -u http://target/ -H 'X-Api-Key: FUZZ' -w <wordlist>
Tips & Tricks
Extensions are opt-in.dir mode brute-forces bare paths only — always pass -x (or -X) with extensions relevant to the stack (php, asp, aspx, jsp, bak, zip, txt, old, ~) or you will silently miss every file.
vhost needs the raw IP in -u, not a hostname — otherwise you’re just DNS-resolving the same vhost on every single request.
Kill soft-404 noise with -b/-s/--exclude-length before scaling up threads — otherwise a custom “not found” page that returns 200 buries every real hit.
Chain with other tools via stdin/stdout:-w - reads the wordlist from stdin, e.g. cat urls.txt | gobuster dir -u <target> -w - isn’t valid (wordlist ≠ URLs) but piping a filtered/generated wordlist in works well: gen_wordlist.sh | gobuster dir -u <target_URL> -w -.
-p/--pattern lets you template the wordlist itself, e.g. a pattern file containing admin-{GOBUSTER} to prefix/suffix every word — useful for guessing versioned or namespaced paths.
When gobuster is too slow to compile a custom wordlist on the fly, generate one first with a dedicated wordlist tool (e.g. cewl, crunch), then feed it in with -w.
--discover-backup is a quick win in CTFs — many challenges leave a .bak/~ copy of a found file sitting next to it.