← retour aux outils back to tools

# Gobuster

Brute-forceur de répertoires/fichiers et de sous-domaines DNS. Outil rapide écrit en Go avec des modes pour les répertoires web, sous-domaines, vhosts, buckets S3 et TFTP. Directory/file and DNS subdomain brute-forcer. Fast Go-based tool with modes for web dirs, subdomains, vhosts, S3 buckets, and TFTP.

↗ https://github.com/OJ/gobuster

## Overview

Gobuster is a brute-forcing tool that covers web directory enumeration, DNS subdomain discovery, virtual host enumeration, S3 bucket fuzzing, and more. It’s faster than DirBuster and simpler than ffuf for straightforward directory scanning.

## Modes

### dir — Web directory/file enumeration

Basic directory scan

    gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt

With extensions

    gobuster dir -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt \
      -x php,html,txt,bak,js

Follow redirects, skip TLS verify, set threads

    gobuster dir -u https://target.com -w wordlist.txt -r -k -t 50

Filter status codes

    gobuster dir -u https://target.com -w wordlist.txt --status-codes-blacklist 404,403

With cookies/auth

    gobuster dir -u https://target.com -w wordlist.txt \
      -c "session=abc123" \
      -H "Authorization: Bearer token123"

Output to file

    gobuster dir -u https://target.com -w wordlist.txt -o results.txt

### dns — Subdomain enumeration

Basic subdomain brute-force

    gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Show IP addresses

    gobuster dns -d target.com -w wordlist.txt -i

Custom DNS resolver

    gobuster dns -d target.com -w wordlist.txt -r 8.8.8.8

### vhost — Virtual host discovery

    gobuster vhost -u https://target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Append domain automatically

    gobuster vhost -u https://target.com -w wordlist.txt --append-domain

### s3 — S3 bucket enumeration

    gobuster s3 -w bucket-names.txt

## Tips

- For `dir` mode, `raft-medium-words.txt` from SecLists gives better coverage than `common.txt`
- Use `-t 50` for speed on stable networks; reduce on rate-limited targets
- `--no-error` suppresses connection errors to keep output clean
- Combine with `-x php,html` to catch config files and source

Help / Man page

    gobuster [command] [flags]

    Commands:
      dir     Directory/file enumeration
      dns     DNS subdomain enumeration
      vhost   Virtual host enumeration
      s3      S3 bucket enumeration
      fuzz    Fuzzing mode

    Global Flags:
      -t threads        Number of concurrent threads (default: 10)
      -w wordlist       Path to wordlist
      -o output         Output file
      -q                Quiet mode
      --delay           Time to wait between requests (e.g. 500ms)
      --timeout         HTTP timeout (default: 10s)

    dir Flags:
      -u URL            Target URL
      -x extensions     File extensions to search for
      -r                Follow redirects
      -k                Skip TLS verification
      -c cookie         Cookies
      -H header         HTTP headers
      -s status-codes   Positive status codes (default: 200,204,301,302,307,401,403,405,500)
      -b blacklist      Status codes to ignore
      --no-tls-validation Skip TLS cert validation

    dns Flags:
      -d domain         Target domain
      -i                Show IP addresses
      -r resolver       Custom DNS resolver

## Vue d’ensemble

Gobuster est un outil de brute-force couvrant l’énumération de répertoires web, la découverte de sous-domaines DNS, l’énumération de virtual hosts, le fuzzing de buckets S3, et plus encore. Il est plus rapide que DirBuster et plus simple que ffuf pour un scan de répertoires basique.

## Modes

### dir : Énumération de répertoires/fichiers web

    # Scan de répertoires basique
    gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt

    # Avec extensions
    gobuster dir -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt \
      -x php,html,txt,bak,js

    # Suivre les redirections, ignorer la vérification TLS, régler les threads
    gobuster dir -u https://target.com -w wordlist.txt -r -k -t 50

    # Filtrer les codes de statut
    gobuster dir -u https://target.com -w wordlist.txt --status-codes-blacklist 404,403

    # Avec cookies/auth
    gobuster dir -u https://target.com -w wordlist.txt \
      -c "session=abc123" \
      -H "Authorization: Bearer token123"

    # Sortie vers un fichier
    gobuster dir -u https://target.com -w wordlist.txt -o results.txt

### dns : Énumération de sous-domaines

    # Brute-force de sous-domaines basique
    gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

    # Afficher les adresses IP
    gobuster dns -d target.com -w wordlist.txt -i

    # Resolver DNS personnalisé
    gobuster dns -d target.com -w wordlist.txt -r 8.8.8.8

### vhost : Découverte de virtual host

    gobuster vhost -u https://target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Ajouter le domaine automatiquement

    gobuster vhost -u https://target.com -w wordlist.txt --append-domain

### s3 : Énumération de buckets S3

    gobuster s3 -w bucket-names.txt

## Conseils

- Pour le mode `dir`, `raft-medium-words.txt` de SecLists offre une meilleure couverture que `common.txt`
- Utiliser `-t 50` pour la vitesse sur des réseaux stables ; réduire sur des cibles limitées en débit
- `--no-error` supprime les erreurs de connexion pour garder une sortie propre
- Combiner avec `-x php,html` pour attraper les fichiers de config et le code source

Aide / Page de manuel

    gobuster [command] [flags]

    Commands:
      dir     Directory/file enumeration
      dns     DNS subdomain enumeration
      vhost   Virtual host enumeration
      s3      S3 bucket enumeration
      fuzz    Fuzzing mode

    Global Flags:
      -t threads        Number of concurrent threads (default: 10)
      -w wordlist       Path to wordlist
      -o output         Output file
      -q                Quiet mode
      --delay           Time to wait between requests (e.g. 500ms)
      --timeout         HTTP timeout (default: 10s)

    dir Flags:
      -u URL            Target URL
      -x extensions     File extensions to search for
      -r                Follow redirects
      -k                Skip TLS verification
      -c cookie         Cookies
      -H header         HTTP headers
      -s status-codes   Positive status codes (default: 200,204,301,302,307,401,403,405,500)
      -b blacklist      Status codes to ignore
      --no-tls-validation Skip TLS cert validation

    dns Flags:
      -d domain         Target domain
      -i                Show IP addresses
      -r resolver       Custom DNS resolver