Gobuster cheatsheet

# Web application extensions
gobuster dir -u http://target.com -w common.txt -x php,php3,php5,phtml

# Backup file discovery (manual)
gobuster dir -u http://target.com -w common.txt -x bak,old,orig,backup,copy,tmp

# Auto-discover backup variants with --discover-backup flag
gobuster dir -u http://target.com -w common.txt -x php --discover-backup

# Config / data files
gobuster dir -u http://target.com -w common.txt -x conf,config,cfg,ini,env,xml,yaml,yml,json

# Java / .NET stack
gobuster dir -u http://target.com -w common.txt -x jsp,jspx,do,action,aspx,asp,ashx

# Multiple purposes in one pass
gobuster dir -u http://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt \
  -x php,html,js,txt,xml,json,bak,old,zip -t 50 -b 404,429

# Default - show common positive codes
gobuster dir -u http://target.com -w common.txt
# Shows: 200,204,301,302,307,401,403

# Only 200 OK (strict)
gobuster dir -u http://target.com -w common.txt -s "200"

# Exclude 404 and rate-limit responses
gobuster dir -u http://target.com -w common.txt -b "404,429"

# Exclude by response body length (e.g. default error page is always 1337 bytes)
gobuster dir -u http://target.com -w common.txt --exclude-length 1337

# Exclude multiple lengths
gobuster dir -u http://target.com -w common.txt --exclude-length 1337,0,2048

# Show length to identify baseline noise
gobuster dir -u http://target.com -w common.txt -l

Pattern files let gobuster append strings to each discovered word. The placeholder {GOBUSTER} is replaced with each word from the wordlist, enabling compound path discovery.

# patterns.txt
{GOBUSTER}/admin
{GOBUSTER}/login
{GOBUSTER}/api/v1
{GOBUSTER}.php.bak
{GOBUSTER}~
_{GOBUSTER}
.{GOBUSTER}

# Use pattern file
gobuster dir -u http://target.com -w common.txt -p patterns.txt

# Practical: discover backup files alongside normal discovery
gobuster dir -u http://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt \
  -p patterns.txt -t 40

# Aggressive authenticated scan through Burp
gobuster dir -u http://target.com -w raft-large-directories.txt \
  -x php,html,txt -b 404 -t 50 -r \
  -H "Authorization: Bearer eyJ..." \
  -H "X-Forwarded-For: 127.0.0.1" \
  --proxy http://127.0.0.1:8080 \
  -o dir-results.txt

# HTTPS with self-signed cert
gobuster dir -u https://192.168.1.1 -w common.txt -k -x php,html

# Slow evasion mode (IDS bypass attempt)
gobuster dir -u http://target.com -w common.txt --delay 200ms -t 5

# Pivot through SOCKS proxy
gobuster dir -u http://internal.corp -w common.txt \
  --proxy socks5://127.0.0.1:1080

# Basic - quiet with IP resolution
gobuster dns -d target.com -w subdomains-top1million-5000.txt -i -q

# Large list, custom resolver, high threads
gobuster dns -d target.com \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt \
  -r 1.1.1.1:53 -t 100 -i -o dns-results.txt

# Force past wildcard DNS (target returns * for all)
gobuster dns -d target.com -w subdomains.txt --wildcard -i

# Internal domain via internal resolver
gobuster dns -d corp.internal -w subdomains.txt -r 192.168.1.53 -t 30

# With timeout for slow DNS
gobuster dns -d target.com -w subdomains.txt --timeout 5s

# Gobuster auto-detects wildcard DNS at startup
# If wildcard found without --wildcard flag, scan aborts
# Output when wildcard detected:
# [-] Wildcard DNS found. IP address(es): 1.2.3.4
# [!] To force processing of Wildcard DNS, specify the '--wildcard' switch.

# Force scan anyway - compare with known wildcard IPs in post-processing
gobuster dns -d target.com -w subdomains.txt --wildcard -i | \
  grep -v "1.2.3.4"

# Basic vhost discovery (wordlist contains full vhost names)
gobuster vhost -u http://10.10.10.10 -w vhosts-full.txt

# Auto-append domain: wordlist has "dev", "staging", result is "dev.target.htb"
gobuster vhost -u http://10.10.10.10 \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  --append-domain -d target.htb -t 50

# Filter noise: identify default page length first, then exclude it
# Step 1: note the length of the default response
curl -s http://10.10.10.10 | wc -c  # e.g. 4242 bytes

# Step 2: exclude that length to reveal real vhosts
gobuster vhost -u http://10.10.10.10 \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  --append-domain -d target.htb \
  --exclude-length 4242 -t 40

# HTTPS vhost (internal lab)
gobuster vhost -u https://192.168.56.10 -k \
  -w subdomains.txt --append-domain -d lab.local \
  --exclude-length 0,612

DNS mode:   Bruteforces DNS resolution. A subdomain is "found" if DNS resolves it.
            Result: host.target.com → 1.2.3.4

VHost mode: Bruteforces the HTTP Host header. A vhost is "found" if the server
            returns a different response than the default.
            Result: Host: dev.target.com → HTTP 200 (not 404)

Use DNS when:   subdomains have real DNS records
Use VHost when: multiple apps share one IP (CTF boxes, internal apps)

# Fuzz URL path segment
gobuster fuzz -u "http://target.com/FUZZ" -w common.txt -b 404

# Fuzz GET parameter value
gobuster fuzz -u "http://target.com/api?user=FUZZ" -w usernames.txt -b 404,400

# Fuzz GET parameter key (discover hidden params)
gobuster fuzz -u "http://target.com/api?FUZZ=test" \
  -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -b 404

# Fuzz POST body
gobuster fuzz -u "http://target.com/login" -m POST \
  -d "username=admin&password=FUZZ" \
  -w /usr/share/seclists/Passwords/Leaked-Databases/rockyou-75.txt \
  -b 401,403 -H "Content-Type: application/x-www-form-urlencoded"

# Fuzz JSON POST body
gobuster fuzz -u "http://target.com/api/auth" -m POST \
  -d '{"username":"admin","password":"FUZZ"}' \
  -w passwords.txt \
  -H "Content-Type: application/json" -b 401

# Fuzz HTTP header value (e.g. Host-based bypass)
gobuster fuzz -u "http://target.com/admin" \
  -H "X-Forwarded-For: FUZZ" \
  -w /usr/share/seclists/Fuzzing/Integers/Integers-onlythree.txt -b 403

# Fuzz in URL fragment / scheme
gobuster fuzz -u "http://target.com/FUZZ.php" \
  -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words-lowercase.txt \
  -b 404 -t 40 --exclude-length 0

# Basic S3 bucket discovery
gobuster s3 -w /usr/share/seclists/Discovery/Web-Content/s3-buckets.txt

# Verbose output (shows ACL status for found buckets)
gobuster s3 -w bucket-names.txt -v

# Higher threads
gobuster s3 -w bucket-names.txt -t 50

# Google Cloud Storage bucket enumeration
gobuster gcs -w /usr/share/seclists/Discovery/Web-Content/s3-buckets.txt -t 50

# TFTP file discovery (requires -s for server)
gobuster tftp -s 10.10.10.1 -w /usr/share/seclists/Discovery/Web-Content/raft-small-files.txt

# TFTP with custom timeout
gobuster tftp -s 192.168.1.1 -w filenames.txt --timeout 3s -t 20

# Fast: high thread count (beware WAF/rate limits)
gobuster dir -u http://target.com -w wordlist.txt -t 100

# Throttled: delay between requests (IDS evasion)
gobuster dir -u http://target.com -w wordlist.txt -t 5 --delay 300ms

# Skip first N words (resume aborted scan)
gobuster dir -u http://target.com -w wordlist.txt --wordlist-offset 50000

# Retry on flaky targets
gobuster dir -u http://target.com -w wordlist.txt --retry --retry-attempts 3

# DNS: increase threads for large wordlists
gobuster dns -d target.com -w top1million.txt -t 150

# Bind to specific interface (multi-homed host)
gobuster dir -u http://target.com -w wordlist.txt --interface eth1

# Skip TLS validation (self-signed cert, lab environment)
gobuster dir -u https://target.com -w wordlist.txt -k

# Use client certificate (mutual TLS)
gobuster dir -u https://target.com -w wordlist.txt \
  --client-cert-p12 client.p12 --client-cert-p12-password "secret"

# Custom CA / pinned cert environment - bypass with -k
gobuster vhost -u https://10.10.10.10 -k -w subdomains.txt \
  --append-domain -d target.htb --exclude-length 0

# Route through Burp Suite (inspect & replay)
gobuster dir -u http://target.com -w wordlist.txt \
  --proxy http://127.0.0.1:8080

# SOCKS5 proxy (pivoting through SSH tunnel)
gobuster dir -u http://internal.corp -w wordlist.txt \
  --proxy socks5://127.0.0.1:1080

# DNS over custom resolver (via internal resolver when pivoting)
gobuster dns -d corp.internal -w subdomains.txt -r 10.10.10.1:53

# Write results to file
gobuster dir -u http://target.com -w wordlist.txt -o results.txt

# Quiet mode - output only results (pipeable)
gobuster dir -u http://target.com -w wordlist.txt -q -o results.txt

# Expanded URLs (full path in output)
gobuster dir -u http://target.com -w wordlist.txt -e

# Show response lengths (useful for baseline identification)
gobuster dir -u http://target.com -w wordlist.txt -l

# Suppress noisy error lines
gobuster dir -u http://target.com -w wordlist.txt --no-error

# Filter gobuster dir output for 200 OK only
grep "\(Status: 200\)" results.txt

# Extract just URLs
grep "\(Status: 200\)" results.txt | awk '{print $1}'

# Pipe quiet output to other tools
gobuster dir -u http://target.com -w wordlist.txt -q | tee results.txt | \
  grep "(Status: 200)"

# Feed discovered dirs back for recursive enumeration (manual recursion)
gobuster dir -u http://target.com -w wordlist.txt -q | \
  awk '{print $1}' | while read path; do
    gobuster dir -u "$path" -w wordlist.txt -q -b 404 >> deep-results.txt
  done

# Go install (recommended, latest)
go install github.com/OJ/gobuster/v3@latest

# Kali / Debian
apt install gobuster

# Docker
docker pull ghcr.io/oj/gobuster:latest
docker run --rm ghcr.io/oj/gobuster:latest dir --help

# Build from source
git clone https://github.com/OJ/gobuster.git
cd gobuster && go build .

# Check version
gobuster version

# List all modes
gobuster --help

# Mode-specific help
gobuster dir --help
gobuster dns --help
gobuster vhost --help
gobuster fuzz --help
gobuster s3 --help
gobuster gcs --help
gobuster tftp --help

• Gobuster GitHub
• SecLists
• feroxbuster
• Assetnote Wordlists
• HackTricks - Web Enumeration
• PayloadsAllTheThings

• ffuf (Web fuzzing - more features)
• Nmap (Network scanning)
• SQLmap (SQL injection)
• Web Toolkit (XSS, SSTI, SSRF, Upload)
• Pentest Toolkit (Methodology)
• Bug Bounty (Platforms and workflows)