🎯 WEEKLY BRIEF
Today we are going over Gobuster. Gobuster is a high performance CLI (command line interface) tool used to discover hidden content on web servers. It is like uncovering a secret passageway or a hidden room.
Most websites dont link to every file they own. Hidden admin panels, backup files (config.zip), and development subdomains (dev.site.com) are goldmines for security researchers. Gobuster automates the process of finding them by guessing names from a massive list at incredible speeds.
🛠️ TOOL OF THE WEEK : GOBUSTER
🫠 Intro to Gobuster
Finding hidden doors of a website SHOULD NOT feel like a guessing game. If you are tired of clicking around or using sluggish tools, its time to master Gobuster!
🚀 Getting Started
If your on Kali Linux you should already have it installed. If not, installation is pretty simple:
Debian-based Linux: sudo apt install gobuster
Fedora-based Linux: sudo dnf install gobuster
Pro Tip: A tool is only as good as its vocabulary. Use SecLists for your wordlists. Install it with sudo apt install seclists.
📂 Mode 1: Directory Busting (dir)
This is the most common use case. You can find hidden folders and files.
The command: gobuster dir -u <TARGET IP OR SITE> -w /usr/share/wordlists/dirb/common.txt
Essential Flags:
-x .php,.html,.txt: Search for specific file extensions.-t 50: Set the thread count (50 is usually the sweet spot for speed).-k: Skip SSL certificate verification (essential for self-signed lab targets).
Flag | Description | Example |
| The target URL you want to scan. |
|
| Search for specific file extensions. |
|
| Skip SSL certificate verification. |
|
| Hide specific HTTP codes. |
|
| Only show specific HTTP codes. |
|
| Specify a custom User-Agent string. |
|
| Follow HTTP redirects (301/302). |
|
🌐 Mode 2: Subdomain Hunting (dns)
You found a main site but want to find the staging or API area? Use DNS mode!
The command: gobuster dns -d <TARGET IP OR SITE> -w /path/to/subdomains.txt
The "Wildcard" Gotcha: If a domain uses wildcard DNS, Gobuster might report that everything exists. Use the --wildcard flag to filter out the noise.
Flag | Description | Example |
| The target domain name. |
|
| Show the IP addresses associated with subdomains. |
|
| Show CNAME records (useful for cloud hunting). |
|
| Force operation even if wildcard DNS is found. |
|
| Use a custom DNS server (e.g., Google or Cloudflare). |
|
‼️3 Pro Tips for Your Next Scan
Output to a File: Use
-o results.txtto save your findings.Filter by Status Code: Use
-b 403,404to hide the "Forbidden" or "Not Found" results.Be Kind: Use
--delay 500msif you are scanning a live production site to avoid being a "denial of service" by accident.
🏳️Global flags you should note
These flags can be used regardless of whether you are in dir or dns mode.
Flag | Description | Example |
| Number of concurrent threads (default: 10). |
|
| Enable verbose output (shows everything). |
|
| Don't display the progress bar (better for logs). |
|
| Only print the results, hide the banner/noise. |
|
| Save results to a specific file. |
|
| Path to the wordlist you want to use. |
|
| Time to wait between requests (stealth mode). |
|