root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat gobuster.md
// web

Gobuster

21 Jul 2026 · 6 min read
webcheatsheetsgobuster
Gobuster is a brute-forcing tool written in Go, designed to discover hidden content in web applications and infrastructure. It enumerates directories, files, DNS subdomains and virtual hosts starting from a wordlist. Its speed and concurrency model make it a must-have in the reconnaissance phase.

What really matters about Gobuster is that it works by mode (dir, dns, vhost, fuzz, s3) and each mode accepts different flags; mixing them up is the most common mistake. It also does not crawl recursively by default: every interesting directory has to be relaunched by hand. The quality of your findings depends more on the wordlist you pick than on the number of threads.

1. Beginner level — directories, DNS and filters

GOBUSTER cheat sheet — Beginner
CommandWhat it does
gobuster dir -u <t> -w <wl>Searches for directories and files
gobuster dir -u <t> -w <wl> -x php,txtAdds extensions to the search
gobuster dir -u <t> -w <wl> -o out.txtSaves results to a file
gobuster dir -u <t> -w <wl> -t 50Adjusts the number of threads
gobuster dir -u <t> -w <wl> -s 200,301Filters by status code
gobuster dir -u <t> -w <wl> -qQuiet mode, no banner
gobuster dns -d <dominio> -w <wl>Enumerates subdomains by brute force
gobuster dir -u <t> -w <wl> -eShows full URLs in the output
gobuster dir -u <t> -w <wl> -zHides the progress bar
gobuster versionShows the installed version
gobuster dir -u <t> -w <wl> -lAdds the response length
gobuster dir -u <t> -w <wl> --no-colorDisables color in the output
gobuster dir -u <t> -w <wl> -nShows paths only, without status
gobuster dir -u <t> -w <wl> -a "Moz/5"Customizes the User-Agent

2. Advanced level — vhosts, auth and proxy

GOBUSTER cheat sheet — Advanced
CommandWhat it does
gobuster vhost -u <t> -w <wl>Enumerates vhosts via the Host header
gobuster fuzz -u <t>/FUZZ -w <wl>Generic fuzzing with the FUZZ marker
gobuster dir -u <t> -w <wl> -kIgnores SSL certificate errors
gobuster dir -u <t> -w <wl> -H "Auth:x"Adds custom headers
gobuster dir -u <t> -w <wl> -c "s=x"Adds cookies to the request
gobuster dir -u <t> -w <wl> -rFollows redirects automatically
gobuster dir -u <t> -w <wl> -b 403,404Excludes status codes
gobuster dir -u <t> -w <wl> --exclude-length 0Filters by response length
gobuster dns -d <dominio> -w <wl> -r <ip>Uses a custom DNS resolver
gobuster s3 -w <wl>Enumerates exposed S3 buckets
gobuster dir -u <t> -w <wl> -P user -V passHTTP basic authentication
gobuster dir -u <t> -w <wl> --proxy <url>Routes requests through a proxy
gobuster dir -u <t> -w <wl> -m POSTChanges the HTTP method used
gobuster dir -u <t> -w <wl> --timeout 5sAdjusts the timeout per request

3. Details people miss

  • Gobuster is not recursive: when you find an interesting directory, relaunch it pointing the URL at that path to keep digging deeper.
  • Each mode (dir, dns, vhost, fuzz) has its own flags; many dir options do not exist in dns and vice versa.
  • The output is only as good as the wordlist: raising -t speeds things up, but it won't find paths that aren't in the dictionary.
  • On HTTPS with self-signed certificates use -k to avoid failing on TLS validation errors.
  • When the server answers 200 to everything, lean on --exclude-length or -b to discard false positives by size or status code.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.