🛠️ Gobuster

Installation

sudo apt install gobuster

Core Modes

This defines what you are brute-forcing.

Mode	Description
dir	Directories
dns	Subdomains
vhost	Virtual hosts (one IP hosts multiple sites)
s3	Public Amazon S3 buckets
fuzz	Generic fuzzing mode

Common Commands

1. Directory Brute-Forcing

gobuster dir -u <target_URL> -w ~/Downloads/SecLists/Discovery/Web-Content/raft-small-directories-lowercase.txt

2. Search for Specific File Extensions (.html, .php, .bak, .txt,…)

gobuster dir -u <target_URL> -w ~/Downloads/SecLists/Discovery/Web-Content/raft-small-directories-lowercase.txt -x php,html,txt,bak

3. Fuzzing for subdomains

gobuster dns -d example.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

4. Fuzzing for virtual hosts

gobuster vhost -u <target_URL> -w ~/Downloads/SecLists/Discovery/DNS/bitquark-subdomains-top100000.txt --append-domain

5. Speeding up

gobuster dir -u <target_URL> -w ~/Downloads/SecLists/Discovery/Web-Content/raft-small-directories-lowercase.txt -t 50

6. Quiet Mode Omit banner and progress bar then pipe the output to a file.

gobuster dir -u <target_URL> -w ~/Downloads/SecLists/Discovery/Web-Content/raft-small-directories-lowercase.txt -q > found_dirs.txt

7. Handling SSL/TLS issues Used when the target has an expired or self-signed certificate.

gobuster dir -u <target_URL> -w ~/Downloads/SecLists/Discovery/Web-Content/raft-small-directories-lowercase.txt -k

Related Usage

File	Created
BKSEC - Low Effort SNS	Tuesday, February 17th 2026, 11:01:44 pm
HTB - Open Secret	Saturday, March 28th 2026, 6:08:31 am