Gobuster: complete enumeration reference

Gobuster performs wordlist-based discovery. Choose a mode first and then add that mode's options. The most useful modes for eJPT-style labs are dir for web paths and files, vhost for name-based virtual hosts, dns for subdomains and fuzz for replacing the FUZZ marker. Current Gobuster 3.x also includes s3, gcs and tftp. Always check the flags installed on your machine because aliases can differ between releases.

The command follows this order: gobuster, the mode, the target, the wordlist and any optional filters. In dir mode, -u or --url selects the target URL and -w or --wordlist selects the list of names to test. Include http:// or https:// and include the application path when the search must start below the web root.

-u / --url: complete target URL.
-w / --wordlist: file containing one candidate per line.
-t / --threads: number of concurrent workers.
-o / --output: file where results will be saved.

-w / --wordlist: path to the wordlist.
-t / --threads: simultaneous workers; more threads are faster but generate more load.
--delay: pause applied by each worker between requests, such as 200ms or 1s.
-o / --output: saves discovered results to a file.
-q / --quiet: hides the banner and unnecessary messages.
-z / --no-progress: hides the live progress counter.
--no-error: suppresses connection and request errors from the output.
--debug: displays diagnostic information, including HTTP request details.
--wordlist-offset: skips the first N lines of a wordlist when continuing a scan.
-p / --pattern and --patterns: apply patterns containing {GOBUSTER} to every word; use carefully because they multiply requests.

-H / --headers: adds an HTTP header; repeat the option to send several headers.
-c / --cookies: sends the supplied Cookie value with every request.
-a / --useragent: defines a custom User-Agent.
--random-agent: selects a random User-Agent.
-U / --username and -P / --password: credentials for HTTP Basic authentication.
-m / --method: HTTP method used for requests, such as GET or POST.
-r / --follow-redirect: follows HTTP redirects.
-k / --no-tls-validation: ignores invalid or self-signed TLS certificates.
--timeout: maximum waiting time for each HTTP request.
--proxy: sends requests through an HTTP(S) or SOCKS5 proxy.
--retry and --retry-attempts: retry timed-out requests and choose the attempt limit.
--interface / --local-ip: select the outgoing network interface or source address.

Client-certificate and TLS-renegotiation options are advanced and their exact syntax should be checked with gobuster dir --help on the installed version.

-s / --status-codes: shows only the selected status codes; accepts lists and ranges.
-b / --status-codes-blacklist: excludes selected codes and normally contains 404 by default. It overrides -s, so use -b "" when applying a positive allowlist.
--exclude-length: ignores responses with selected content lengths; accepts values and ranges.
-l / --include-length: prints the response size, useful for identifying false positives.
-n / --no-status: omits HTTP status codes from displayed results.
-e / --expanded: prints the complete URL for every result.

-f / --add-slash: appends / to every candidate, useful when testing directories.
--discover-backup: checks common backup variants related to discovered files.
--force: continues when the initial server precheck fails; inspect its results carefully.

Responses 301 and 302 indicate redirects. A 401 requires authentication and a 403 usually confirms that the path exists but access is forbidden. These results should not be discarded automatically.

-x / --extensions: receives extensions separated by commas and tests them against every word.
-X / --extensions-file: reads the extensions from a file containing one extension per line.

Do not write the initial dot: use php,txt,bak rather than .php,.txt,.bak. For example, if the wordlist contains admin and -x php,txt is used, Gobuster tests /admin, /admin.php and /admin.txt. Every added extension increases the number of requests, so select them according to the server technology.

Common choices: php for PHP applications; asp and aspx for IIS; jsp for Java; html and htm for static pages; js, json and xml for applications or APIs; txt, bak, old, zip and sql for exposed files and backups.

Vhost mode changes the Host header and detects websites sharing the same IP. Point -u at the IP or known site. --append-domain adds the base domain to each word; otherwise the wordlist must contain complete hostnames. --domain explicitly supplies the domain when the URL is an IP. --exclude-status and --exclude-length remove uniform false positives, and --exclude-hostname-length adjusts length filtering when the reflected hostname changes each response.

DNS mode resolves candidate subdomains. Use -do or --domain for the base domain and -r or --resolver for a specific DNS server. --show-ips includes resolved addresses, --check-cname checks CNAME records, --no-fqdn avoids system search-domain expansion, and --wildcard forces continuation when wildcard DNS is detected. Confirm wildcard findings manually because random names may resolve to the same address.

Fuzz mode replaces FUZZ in a URL, query string, request body or header with every wordlist entry. It is useful when dir mode cannot place input in the required location. Use filtering to remove the baseline response and keep the request rate controlled.

Identify the web technology first, run a small directory list, inspect redirects and forbidden paths, then add only relevant extensions. Repeat against discovered base paths and nonstandard web ports. If the IP serves a generic page, test virtual hosts. Record the exact URL, status and length, then confirm every valuable result with curl or a browser. Gobuster discovers candidates; it does not prove that a finding is exploitable.

If Gobuster reports that the server answers nonexistent URLs with the same status, request a random path and note its length, then exclude that length or narrow accepted status codes. Reduce threads or add delay after timeouts and rate limiting. Use -k only for certificate validation errors. A 403 result is still useful because it confirms a path exists; test its trailing slash, capitalization, alternate extension and permitted HTTP methods rather than discarding it.