retour aux outils back to tools Ducklings

Gobuster

Brute-forceur de répertoires/fichiers et de sous-domaines DNS. Outil rapide écrit en Go avec des modes pour les répertoires web, sous-domaines, vhosts, buckets S3 et TFTP. Directory/file and DNS subdomain brute-forcer. Fast Go-based tool with modes for web dirs, subdomains, vhosts, S3 buckets, and TFTP.

↗ https://github.com/OJ/gobuster

Overview

Gobuster is a brute-forcing tool that covers web directory enumeration, DNS subdomain discovery, virtual host enumeration, S3 bucket fuzzing, and more. It’s faster than DirBuster and simpler than ffuf for straightforward directory scanning.

Modes

dir — Web directory/file enumeration

Basic directory scan

gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt

With extensions

gobuster dir -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt \
  -x php,html,txt,bak,js

Follow redirects, skip TLS verify, set threads

gobuster dir -u https://target.com -w wordlist.txt -r -k -t 50

Filter status codes

gobuster dir -u https://target.com -w wordlist.txt --status-codes-blacklist 404,403

With cookies/auth

gobuster dir -u https://target.com -w wordlist.txt \
  -c "session=abc123" \
  -H "Authorization: Bearer token123"

Output to file

gobuster dir -u https://target.com -w wordlist.txt -o results.txt

dns — Subdomain enumeration

Basic subdomain brute-force

gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Show IP addresses

gobuster dns -d target.com -w wordlist.txt -i

Custom DNS resolver

gobuster dns -d target.com -w wordlist.txt -r 8.8.8.8

vhost — Virtual host discovery

gobuster vhost -u https://target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Append domain automatically

gobuster vhost -u https://target.com -w wordlist.txt --append-domain

s3 — S3 bucket enumeration

gobuster s3 -w bucket-names.txt

Tips

  • For dir mode, raft-medium-words.txt from SecLists gives better coverage than common.txt
  • Use -t 50 for speed on stable networks; reduce on rate-limited targets
  • --no-error suppresses connection errors to keep output clean
  • Combine with -x php,html to catch config files and source
Help / Man page 
gobuster [command] [flags]

Commands:
  dir     Directory/file enumeration
  dns     DNS subdomain enumeration
  vhost   Virtual host enumeration
  s3      S3 bucket enumeration
  fuzz    Fuzzing mode

Global Flags:
  -t threads        Number of concurrent threads (default: 10)
  -w wordlist       Path to wordlist
  -o output         Output file
  -q                Quiet mode
  --delay           Time to wait between requests (e.g. 500ms)
  --timeout         HTTP timeout (default: 10s)

dir Flags:
  -u URL            Target URL
  -x extensions     File extensions to search for
  -r                Follow redirects
  -k                Skip TLS verification
  -c cookie         Cookies
  -H header         HTTP headers
  -s status-codes   Positive status codes (default: 200,204,301,302,307,401,403,405,500)
  -b blacklist      Status codes to ignore
  --no-tls-validation Skip TLS cert validation

dns Flags:
  -d domain         Target domain
  -i                Show IP addresses
  -r resolver       Custom DNS resolver

Vue d’ensemble

Gobuster est un outil de brute-force couvrant l’énumération de répertoires web, la découverte de sous-domaines DNS, l’énumération de virtual hosts, le fuzzing de buckets S3, et plus encore. Il est plus rapide que DirBuster et plus simple que ffuf pour un scan de répertoires basique.

Modes

dir : Énumération de répertoires/fichiers web

# Scan de répertoires basique
gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt

# Avec extensions
gobuster dir -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt \
  -x php,html,txt,bak,js

# Suivre les redirections, ignorer la vérification TLS, régler les threads
gobuster dir -u https://target.com -w wordlist.txt -r -k -t 50

# Filtrer les codes de statut
gobuster dir -u https://target.com -w wordlist.txt --status-codes-blacklist 404,403

# Avec cookies/auth
gobuster dir -u https://target.com -w wordlist.txt \
  -c "session=abc123" \
  -H "Authorization: Bearer token123"

# Sortie vers un fichier
gobuster dir -u https://target.com -w wordlist.txt -o results.txt

dns : Énumération de sous-domaines

# Brute-force de sous-domaines basique
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Afficher les adresses IP
gobuster dns -d target.com -w wordlist.txt -i

# Resolver DNS personnalisé
gobuster dns -d target.com -w wordlist.txt -r 8.8.8.8

vhost : Découverte de virtual host

gobuster vhost -u https://target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Ajouter le domaine automatiquement

gobuster vhost -u https://target.com -w wordlist.txt --append-domain

s3 : Énumération de buckets S3

gobuster s3 -w bucket-names.txt

Conseils

  • Pour le mode dir, raft-medium-words.txt de SecLists offre une meilleure couverture que common.txt
  • Utiliser -t 50 pour la vitesse sur des réseaux stables ; réduire sur des cibles limitées en débit
  • --no-error supprime les erreurs de connexion pour garder une sortie propre
  • Combiner avec -x php,html pour attraper les fichiers de config et le code source
Aide / Page de manuel 
gobuster [command] [flags]

Commands:
  dir     Directory/file enumeration
  dns     DNS subdomain enumeration
  vhost   Virtual host enumeration
  s3      S3 bucket enumeration
  fuzz    Fuzzing mode

Global Flags:
  -t threads        Number of concurrent threads (default: 10)
  -w wordlist       Path to wordlist
  -o output         Output file
  -q                Quiet mode
  --delay           Time to wait between requests (e.g. 500ms)
  --timeout         HTTP timeout (default: 10s)

dir Flags:
  -u URL            Target URL
  -x extensions     File extensions to search for
  -r                Follow redirects
  -k                Skip TLS verification
  -c cookie         Cookies
  -H header         HTTP headers
  -s status-codes   Positive status codes (default: 200,204,301,302,307,401,403,405,500)
  -b blacklist      Status codes to ignore
  --no-tls-validation Skip TLS cert validation

dns Flags:
  -d domain         Target domain
  -i                Show IP addresses
  -r resolver       Custom DNS resolver