repository·master·Indexed 12 days ago
https://github.com/oj/gobusterA high-performance, multi-threaded brute-forcing tool written in Go for security professionals. It features multiple modes for enumeration, including directory and file discovery (dir), DNS subdomain discovery (dns), virtual host detection (vhost), Amazon S3 and Google Cloud Storage bucket enumeration (s3, gcs), TFTP file discovery (tftp), and custom parameter fuzzing (fuzz).
Gobuster operates using a mode-based CLI structure. You must specify a mode before providing options. The general syntax is:
gobuster [mode] [options]Available modes include:
dir: Web directory and file enumeration.dns: DNS subdomain discovery.vhost: Virtual host detection.s3: Amazon S3 bucket enumeration.gcs: Google Cloud Storage bucket enumeration.tftp: TFTP file discovery.fuzz: Custom fuzzing using the FUZZ keyword.gobuster [mode] [options]You can install Gobuster using several methods depending on your environment. The recommended method is using go install if you have Go 1.24 or higher installed.
go install github.com/OJ/gobuster/v3@latestPull the latest image and run it directly:
docker pull ghcr.io/oj/gobuster:latest
docker run --rm -it ghcr.io/oj/gobuster:latest [mode] [options]git clone https://github.com/OJ/gobuster.git
cd gobuster
go mod tidy
go buildDownload pre-compiled binaries from the GitHub releases page.
go install github.com/OJ/gobuster/v3@latest-t or adding delays with --delay. You can also try a different user agent with -a.--timeout or reduce the thread count -t.-s (status code) flag.-t (use caution to avoid overwhelming the target) or use smaller, more targeted wordlists.The libgobuster.Options struct (passed to the Gobuster function) controls how results and progress are displayed:
Quiet: If true, suppresses most output, including the banner and progress updates. Only results (and potentially errors/messages depending on other flags) are shown.NoProgress: If true, disables the periodic progress percentage updates in the terminal.OutputFilename: If a string is provided, results are written to this file in addition to being printed to stdout.WordlistOffset: An integer that allows skipping the first n elements of the wordlist.Note: If the process is not running in a terminal (e.g., piped to another command), NoProgress is automatically set to true to prevent terminal escape codes from cluttering the output.
--wildcard flag.Gobuster can discover open Amazon S3 and Google Cloud Storage (GCS) buckets.
S3 Mode:
-w: Wordlist of bucket names.--debug: Enable debug output.GCS Mode:
-w: Wordlist of bucket names.--debug: Enable debug output.gobuster s3 -w bucket-names.txt
gobuster gcs -w bucket-names.txt --debugUse vhost mode to identify virtual hosts on a target web server.
Common Options:
-u: Target URL.-w: Wordlist.--append-domain: Appends the target domain to the wordlist entries.gobuster vhost -u https://example.com --append-domain -w wordlist.txtThe fuzz mode allows you to inject wordlist entries into specific locations in a request using the FUZZ keyword.
Common Use Cases:
gobuster fuzz -u https://example.com?param=FUZZ -w wordlist.txtgobuster fuzz -u https://example.com -H "X-Custom-Header: FUZZ" -w wordlist.txtgobuster fuzz -u https://example.com -d "username=admin&password=FUZZ" -w passwords.txtgobuster fuzz -u https://example.com?FUZZ=test -w wordlist.txtUse dns mode to find subdomains via DNS resolution. You must provide the target domain (-do) and a wordlist (-w).
Common Options:
-do: The target domain to enumerate.-w: Path to the wordlist.-r: Custom DNS server (e.g., -r 8.8.8.8:53).-t: Number of concurrent threads (e.g., -t 50).gobuster dns -do example.com -w /path/to/wordlist.txtUse dir mode to discover hidden directories and files on a web server. You must provide a target URL (-u) and a wordlist (-w).
Common Options:
-u: Target URL.-w: Path to the wordlist.-x: File extensions to search for (e.g., php,html,js).-H: Custom HTTP headers (e.g., -H "Authorization: Bearer token").-c: Custom cookies (e.g., -c "session=value").-l: Show response length.-s: Filter by status codes (e.g., -s 200,301,302).-o: Save results to a file.-q: Quiet mode for clean output.gobuster dir -u https://example.com -w wordlist.txtThe Gobuster function serves as the main entrypoint for running the Gobuster engine. It orchestrates the execution of a specific plugin, manages logging, handles output (to stdout or a file), and manages progress reporting.
To use it, you must provide a context.Context, a pointer to libgobuster.Options, a libgobuster.GobusterPlugin implementation, and a libgobuster.Logger instance.
err := cli.Gobuster(ctx, opts, plugin, log)
if err != nil {
// handle error
}The RegexpHandler struct implements the http.Handler interface and allows you to register multiple routes based on regular expression patterns. When a request arrives, the handler iterates through the registered routes in the order they were added and executes the first handler whose pattern matches the request URL path. If no pattern matches, it returns a 404 Not Found response.
To use it, you can register routes using either Handler (for http.Handler types) or HandleFunc (for standard function signatures).
// Initialize the handler
x := RegexpHandler{}
// Register a route with a specific pattern and a handler function
x.HandleFunc(regexp.MustCompile(`^/api/v1/.*`), func(w http.ResponseWriter, r *http.Request) {
w.Write([]byte("Matched API route"))
})
// Register a route with an http.Handler
x.Handler(regexp.MustCompile(`^/static/.*`), myStaticFileHandler)
// Start the server
http.ListenAndServe("127.0.0.1:8081", &x)