oj / gobuster

Directory/File, DNS and VHost busting tool written in Go

Gobuster

Gobuster is a tool used to brute-force:

• URIs (directories and files) in web sites.
• DNS subdomains (with wildcard support).
• Virtual Host names on target web servers.
• Open Amazon S3 buckets
• Open Google Cloud buckets
• TFTP servers

Tags, Statuses, etc

Love this tool? Back it!

If you're backing us already, you rock. If you're not, that's cool too! Want to back us? Become a backer!

All funds that are donated to this project will be donated to charity. A full log of charity donations will be available in this repository as they are processed.

Changes

3.6

• Wordlist offset parameter to skip x lines from the wordlist
• prevent double slashes when building up an url in dir mode
• allow for multiple values and ranges on --exclude-length
• no-fqdn parameter on dns bruteforce to disable the use of the systems search domains. This should speed up the run if you have configured some search domains. #418

3.5

• Allow Ranges in status code and status code blacklist. Example: 200,300-305,404

3.4

• Enable TLS1.0 and TLS1.1 support
• Add TFTP mode to search for files on tftp servers

3.3

• Support TLS client certificates / mtls
• support loading extensions from file
• support fuzzing POST body, HTTP headers and basic auth
• new option to not canonicalize header names

3.2

• Use go 1.19
• use contexts in the correct way
• get rid of the wildcard flag (except in DNS mode)
• color output
• retry on timeout
• google cloud bucket enumeration
• fix nil reference errors

3.1

• enumerate public AWS S3 buckets
• fuzzing mode
• specify HTTP method
• added support for patterns. You can now specify a file containing patterns that are applied to every word, one by line. Every occurrence of the term {GOBUSTER} in it will be replaced with the current wordlist item. Please use with caution as this can cause increase the number of requests issued a lot.
• The shorthand p flag which was assigned to proxy is now used by the pattern flag

3.0

• New CLI options so modes are strictly separated (-m is now gone!)
• Performance Optimizations and better connection handling
• Ability to enumerate vhost names
• Option to supply custom HTTP headers

License

See the LICENSE file.

Manual

Available Modes

• dir - the classic directory brute-forcing mode
• dns - DNS subdomain brute-forcing mode
• s3 - Enumerate open S3 buckets and look for existence and bucket listings
• gcs - Enumerate open google cloud buckets
• vhost - virtual host brute-forcing mode (not the same as DNS!)
• fuzz - some basic fuzzing, replaces the FUZZ keyword
• tftp - bruteforce tftp files

Easy Installation

Binary Releases

We are now shipping binaries for each of the releases so that you don't even have to build them yourself! How wonderful is that!

If you're stupid enough to trust binaries that I've put together, you can download them from the releases page.

Docker

You can also grab a prebuilt docker image from https://github.com/OJ/gobuster/pkgs/container/gobuster

docker pull ghcr.io/oj/gobuster:latest

Using go install

If you have a Go environment ready to go (at least go 1.19), it's as easy as:

go install github.com/OJ/gobuster/v3@latest

PS: You need at least go 1.19 to compile gobuster.

Building From Source

Since this tool is written in Go you need to install the Go language/compiler/etc. Full details of installation and set up can be found on the Go language website. Once installed you have two options. You need at least go 1.19 to compile gobuster.

Compiling

gobuster has external dependencies, and so they need to be pulled in first:

go get && go build

This will create a gobuster binary for you. If you want to install it in the $GOPATH/bin folder you can run:

go install

Modes

Help is built-in!

• gobuster help - outputs the top-level help.
• gobuster help <mode> - outputs the help specific to that mode.

dns Mode

Options

Uses DNS subdomain enumeration mode

Usage:
  gobuster dns [flags]

Flags:
  -d, --domain string      The target domain
  -h, --help               help for dns
  -r, --resolver string    Use custom DNS server (format server.com or server.com:port)
  -c, --show-cname         Show CNAME records (cannot be used with '-i' option)
  -i, --show-ips           Show IP addresses
      --timeout duration   DNS resolver timeout (default 1s)
      --wildcard           Force continued operation when wildcard found

Global Flags:
      --delay duration    Time each thread waits between requests (e.g. 1500ms)
      --no-color          Disable color output
      --no-error          Don't display errors
  -z, --no-progress       Don't display progress
  -o, --output string     Output file to write results to (defaults to stdout)
  -p, --pattern string    File containing replacement patterns
  -q, --quiet             Don't print the banner and other noise
  -t, --threads int       Number of concurrent threads (default 10)
  -v, --verbose           Verbose output (errors)
  -w, --wordlist string   Path to the wordlist

Examples

gobuster dns -d mysite.com -t 50 -w common-names.txt

Normal sample run goes like this:

gobuster dns -d google.com -w ~/wordlists/subdomains.txt

===============================================================
Gobuster v3.2.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Mode         : dns
[+] Url/Domain   : google.com
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/subdomains.txt
===============================================================
2019/06/21 11:54:20 Starting gobuster
===============================================================
Found: chrome.google.com
Found: ns1.google.com
Found: admin.google.com
Found: www.google.com
Found: m.google.com
Found: support.google.com
Found: translate.google.com
Found: cse.google.com
Found: news.google.com
Found: music.google.com
Found: mail.google.com
Found: store.google.com
Found: mobile.google.com
Found: search.google.com
Found: wap.google.com
Found: directory.google.com
Found: local.google.com
Found: blog.google.com
===============================================================
2019/06/21 11:54:20 Finished
===============================================================

Show IP sample run goes like this:

gobuster dns -d google.com -w ~/wordlists/subdomains.txt -i

===============================================================
Gobuster v3.2.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Mode         : dns
[+] Url/Domain   : google.com
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/subdomains.txt
===============================================================
2019/06/21 11:54:54 Starting gobuster
===============================================================
Found: www.google.com [172.217.25.36, 2404:6800:4006:802::2004]
Found: admin.google.com [172.217.25.46, 2404:6800:4006:806::200e]
Found: store.google.com [172.217.167.78, 2404:6800:4006:802::200e]
Found: mobile.google.com [172.217.25.43, 2404:6800:4006:802::200b]
Found: ns1.google.com [216.239.32.10, 2001:4860:4802:32::a]
Found: m.google.com [172.217.25.43, 2404:6800:4006:802::200b]
Found: cse.google.com [172.217.25.46, 2404:6800:4006:80a::200e]
Found: chrome.google.com [172.217.25.46, 2404:6800:4006:802::200e]
Found: search.google.com [172.217.25.46, 2404:6800:4006:802::200e]
Found: local.google.com [172.217.25.46, 2404:6800:4006:80a::200e]
Found: news.google.com [172.217.25.46, 2404:6800:4006:802::200e]
Found: blog.google.com [216.58.199.73, 2404:6800:4006:806::2009]
Found: support.google.com [172.217.25.46, 2404:6800:4006:802::200e]
Found: wap.google.com [172.217.25.46, 2404:6800:4006:802::200e]
Found: directory.google.com [172.217.25.46, 2404:6800:4006:802::200e]
Found: translate.google.com [172.217.25.46, 2404:6800:4006:802::200e]
Found: music.google.com [172.217.25.46, 2404:6800:4006:802::200e]
Found: mail.google.com [172.217.25.37, 2404:6800:4006:802::2005]
===============================================================
2019/06/21 11:54:55 Finished
===============================================================

Base domain validation warning when the base domain fails to resolve. This is a warning rather than a failure in case the user fat-fingers while typing the domain.

gobuster dns -d yp.to -w ~/wordlists/subdomains.txt -i

===============================================================
Gobuster v3.2.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Mode         : dns
[+] Url/Domain   : yp.to
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/subdomains.txt
===============================================================
2019/06/21 11:56:43 Starting gobuster
===============================================================
2019/06/21 11:56:53 [-] Unable to validate base domain: yp.to
Found: cr.yp.to [131.193.32.108, 131.193.32.109]
===============================================================
2019/06/21 11:56:53 Finished
===============================================================

Wildcard DNS is also detected properly:

gobuster dns -d 0.0.1.xip.io -w ~/wordlists/subdomains.txt

===============================================================
Gobuster v3.2.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Mode         : dns
[+] Url/Domain   : 0.0.1.xip.io
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/subdomains.txt
===============================================================
2019/06/21 12:13:48 Starting gobuster
===============================================================
2019/06/21 12:13:48 [-] Wildcard DNS found. IP address(es): 1.0.0.0
2019/06/21 12:13:48 [!] To force processing of Wildcard DNS, specify the '--wildcard' switch.
===============================================================
2019/06/21 12:13:48 Finished
===============================================================

If the user wants to force processing of a domain that has wildcard entries, use --wildcard:

gobuster dns -d 0.0.1.xip.io -w ~/wordlists/subdomains.txt --wildcard

===============================================================
Gobuster v3.2.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Mode         : dns
[+] Url/Domain   : 0.0.1.xip.io
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/subdomains.txt
===============================================================
2019/06/21 12:13:51 Starting gobuster
===============================================================
2019/06/21 12:13:51 [-] Wildcard DNS found. IP address(es): 1.0.0.0
Found: 127.0.0.1.xip.io
Found: test.127.0.0.1.xip.io
===============================================================
2019/06/21 12:13:53 Finished
===============================================================

dir Mode

Options

Uses directory/file enumeration mode

Usage:
  gobuster dir [flags]

Flags:
  -f, --add-slash                       Append / to each request
  -c, --cookies string                  Cookies to use for the requests
  -d, --discover-backup                 Also search for backup files by appending multiple backup extensions
      --exclude-length ints             exclude the following content length (completely ignores the status). Supply multiple times to exclude multiple sizes.
  -e, --expanded                        Expanded mode, print full URLs
  -x, --extensions string               File extension(s) to search for
  -r, --follow-redirect                 Follow redirects
  -H, --headers stringArray             Specify HTTP headers, -H 'Header1: val1' -H 'Header2: val2'
  -h, --help                            help for dir
      --hide-length                     Hide the length of the body in the output
  -m, --method string                   Use the following HTTP method (default "GET")
  -n, --no-status                       Don't print status codes
  -k, --no-tls-validation               Skip TLS certificate verification
  -P, --password string                 Password for Basic Auth
      --proxy string                    Proxy to use for requests [http(s)://host:port]
      --random-agent                    Use a random User-Agent string
      --retry                           Should retry on request timeout
      --retry-attempts int              Times to retry on request timeout (default 3)
  -s, --status-codes string             Positive status codes (will be overwritten with status-codes-blacklist if set)
  -b, --status-codes-blacklist string   Negative status codes (will override status-codes if set) (default "404")
      --timeout duration                HTTP Timeout (default 10s)
  -u, --url string                      The target URL
  -a, --useragent string                Set the User-Agent string (default "gobuster/3.2.0")
  -U, --username string                 Username for Basic Auth

Global Flags:
      --delay duration    Time each thread waits between requests (e.g. 1500ms)
      --no-color          Disable color output
      --no-error          Don't display errors
  -z, --no-progress       Don't display progress
  -o, --output string     Output file to write results to (defaults to stdout)
  -p, --pattern string    File containing replacement patterns
  -q, --quiet             Don't print the banner and other noise
  -t, --threads int       Number of concurrent threads (default 10)
  -v, --verbose           Verbose output (errors)
  -w, --wordlist string   Path to the wordlist

Examples

gobuster dir -u https://mysite.com/path/to/folder -c 'session=123456' -t 50 -w common-files.txt -x .php,.html

Default options looks like this:

gobuster dir -u https://buffered.io -w ~/wordlists/shortlist.txt

===============================================================
Gobuster v3.2.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Mode         : dir
[+] Url/Domain   : https://buffered.io/
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/shortlist.txt
[+] Status codes : 200,204,301,302,307,401,403
[+] User Agent   : gobuster/3.2.0
[+] Timeout      : 10s
===============================================================
2019/06/21 11:49:43 Starting gobuster
===============================================================
/categories (Status: 301)
/contact (Status: 301)
/posts (Status: 301)
/index (Status: 200)
===============================================================
2019/06/21 11:49:44 Finished
===============================================================

Default options with status codes disabled looks like this:

gobuster dir -u https://buffered.io -w ~/wordlists/shortlist.txt -n

===============================================================
Gobuster v3.2.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Mode         : dir
[+] Url/Domain   : https://buffered.io/
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/shortlist.txt
[+] Status codes : 200,204,301,302,307,401,403
[+] User Agent   : gobuster/3.2.0
[+] No status    : true
[+] Timeout      : 10s
===============================================================
2019/06/21 11:50:18 Starting gobuster
===============================================================
/categories
/contact
/index
/posts
===============================================================
2019/06/21 11:50:18 Finished
===============================================================

Verbose output looks like this:

gobuster dir -u https://buffered.io -w ~/wordlists/shortlist.txt -v

===============================================================
Gobuster v3.2.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Mode         : dir
[+] Url/Domain   : https://buffered.io/
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/shortlist.txt
[+] Status codes : 200,204,301,302,307,401,403
[+] User Agent   : gobuster/3.2.0
[+] Verbose      : true
[+] Timeout      : 10s
===============================================================
2019/06/21 11:50:51 Starting gobuster
===============================================================
Missed: /alsodoesnotexist (Status: 404)
Found: /index (Status: 200)
Missed: /doesnotexist (Status: 404)
Found: /categories (Status: 301)
Found: /posts (Status: 301)
Found: /contact (Status: 301)
===============================================================
2019/06/21 11:50:51 Finished
===============================================================

Example showing content length:

gobuster dir -u https://buffered.io -w ~/wordlists/shortlist.txt -l

===============================================================
Gobuster v3.2.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Mode         : dir
[+] Url/Domain   : https://buffered.io/
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/shortlist.txt
[+] Status codes : 200,204,301,302,307,401,403
[+] User Agent   : gobuster/3.2.0
[+] Show length  : true
[+] Timeout      : 10s
===============================================================
2019/06/21 11:51:16 Starting gobuster
===============================================================
/categories (Status: 301) [Size: 178]
/posts (Status: 301) [Size: 178]
/contact (Status: 301) [Size: 178]
/index (Status: 200) [Size: 51759]
===============================================================
2019/06/21 11:51:17 Finished
===============================================================

Quiet output, with status disabled and expanded mode looks like this ("grep mode"):

gobuster dir -u https://buffered.io -w ~/wordlists/shortlist.txt -q -n -e
https://buffered.io/index
https://buffered.io/contact
https://buffered.io/posts
https://buffered.io/categories

vhost Mode

Options

Uses VHOST enumeration mode (you most probably want to use the IP address as the URL parameter)

Usage:
  gobuster vhost [flags]

Flags:
      --append-domain         Append main domain from URL to words from wordlist. Otherwise the fully qualified domains need to be specified in the wordlist.
  -c, --cookies string        Cookies to use for the requests
      --domain string         the domain to append when using an IP address as URL. If left empty and you specify a domain based URL the hostname from the URL is extracted
      --exclude-length ints   exclude the following content length (completely ignores the status). Supply multiple times to exclude multiple sizes.
  -r, --follow-redirect       Follow redirects
  -H, --headers stringArray   Specify HTTP headers, -H 'Header1: val1' -H 'Header2: val2'
  -h, --help                  help for vhost
  -m, --method string         Use the following HTTP method (default "GET")
  -k, --no-tls-validation     Skip TLS certificate verification
  -P, --password string       Password for Basic Auth
      --proxy string          Proxy to use for requests [http(s)://host:port]
      --random-agent          Use a random User-Agent string
      --retry                 Should retry on request timeout
      --retry-attempts int    Times to retry on request timeout (default 3)
      --timeout duration      HTTP Timeout (default 10s)
  -u, --url string            The target URL
  -a, --useragent string      Set the User-Agent string (default "gobuster/3.2.0")
  -U, --username string       Username for Basic Auth

Global Flags:
      --delay duration    Time each thread waits between requests (e.g. 1500ms)
      --no-color          Disable color output
      --no-error          Don't display errors
  -z, --no-progress       Don't display progress
  -o, --output string     Output file to write results to (defaults to stdout)
  -p, --pattern string    File containing replacement patterns
  -q, --quiet             Don't print the banner and other noise
  -t, --threads int       Number of concurrent threads (default 10)
  -v, --verbose           Verbose output (errors)
  -w, --wordlist string   Path to the wordlist

Examples

gobuster vhost -u https://mysite.com -w common-vhosts.txt

Normal sample run goes like this:

gobuster vhost -u https://mysite.com -w common-vhosts.txt

===============================================================
Gobuster v3.2.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:          https://mysite.com
[+] Threads:      10
[+] Wordlist:     common-vhosts.txt
[+] User Agent:   gobuster/3.2.0
[+] Timeout:      10s
===============================================================
2019/06/21 08:36:00 Starting gobuster
===============================================================
Found: www.mysite.com
Found: piwik.mysite.com
Found: mail.mysite.com
===============================================================
2019/06/21 08:36:05 Finished
===============================================================

fuzz Mode

Options

Uses fuzzing mode

Usage:
  gobuster fuzz [flags]

Flags:
  -c, --cookies string              Cookies to use for the requests
      --exclude-length ints         exclude the following content length (completely ignores the status). Supply multiple times to exclude multiple sizes.
  -b, --excludestatuscodes string   Negative status codes (will override statuscodes if set)
  -r, --follow-redirect             Follow redirects
  -H, --headers stringArray         Specify HTTP headers, -H 'Header1: val1' -H 'Header2: val2'
  -h, --help                        help for fuzz
  -m, --method string               Use the following HTTP method (default "GET")
  -k, --no-tls-validation           Skip TLS certificate verification
  -P, --password string             Password for Basic Auth
      --proxy string                Proxy to use for requests [http(s)://host:port]
      --random-agent                Use a random User-Agent string
      --retry                       Should retry on request timeout
      --retry-attempts int          Times to retry on request timeout (default 3)
      --timeout duration            HTTP Timeout (default 10s)
  -u, --url string                  The target URL
  -a, --useragent string            Set the User-Agent string (default "gobuster/3.2.0")
  -U, --username string             Username for Basic Auth

Global Flags:
      --delay duration    Time each thread waits between requests (e.g. 1500ms)
      --no-color          Disable color output
      --no-error          Don't display errors
  -z, --no-progress       Don't display progress
  -o, --output string     Output file to write results to (defaults to stdout)
  -p, --pattern string    File containing replacement patterns
  -q, --quiet             Don't print the banner and other noise
  -t, --threads int       Number of concurrent threads (default 10)
  -v, --verbose           Verbose output (errors)
  -w, --wordlist string   Path to the wordlist

Examples

gobuster fuzz -u https://example.com?FUZZ=test -w parameter-names.txt

s3 Mode

Options

Uses aws bucket enumeration mode

Usage:
  gobuster s3 [flags]

Flags:
  -h, --help                 help for s3
  -m, --maxfiles int         max files to list when listing buckets (only shown in verbose mode) (default 5)
  -k, --no-tls-validation    Skip TLS certificate verification
      --proxy string         Proxy to use for requests [http(s)://host:port]
      --random-agent         Use a random User-Agent string
      --retry                Should retry on request timeout
      --retry-attempts int   Times to retry on request timeout (default 3)
      --timeout duration     HTTP Timeout (default 10s)
  -a, --useragent string     Set the User-Agent string (default "gobuster/3.2.0")

Global Flags:
      --delay duration    Time each thread waits between requests (e.g. 1500ms)
      --no-color          Disable color output
      --no-error          Don't display errors
  -z, --no-progress       Don't display progress
  -o, --output string     Output file to write results to (defaults to stdout)
  -p, --pattern string    File containing replacement patterns
  -q, --quiet             Don't print the banner and other noise
  -t, --threads int       Number of concurrent threads (default 10)
  -v, --verbose           Verbose output (errors)
  -w, --wordlist string   Path to the wordlist

Examples

gobuster s3 -w bucket-names.txt

gcs Mode

Options

Uses gcs bucket enumeration mode

Usage:
  gobuster gcs [flags]

Flags:
  -h, --help                 help for gcs
  -m, --maxfiles int         max files to list when listing buckets (only shown in verbose mode) (default 5)
  -k, --no-tls-validation    Skip TLS certificate verification
      --proxy string         Proxy to use for requests [http(s)://host:port]
      --random-agent         Use a random User-Agent string
      --retry                Should retry on request timeout
      --retry-attempts int   Times to retry on request timeout (default 3)
      --timeout duration     HTTP Timeout (default 10s)
  -a, --useragent string     Set the User-Agent string (default "gobuster/3.2.0")

Global Flags:
      --delay duration    Time each thread waits between requests (e.g. 1500ms)
      --no-color          Disable color output
      --no-error          Don't display errors
  -z, --no-progress       Don't display progress
  -o, --output string     Output file to write results to (defaults to stdout)
  -p, --pattern string    File containing replacement patterns
  -q, --quiet             Don't print the banner and other noise
  -t, --threads int       Number of concurrent threads (default 10)
  -v, --verbose           Verbose output (errors)
  -w, --wordlist string   Path to the wordlist

Examples

gobuster gcs -w bucket-names.txt

tftp Mode

Options

Uses TFTP enumeration mode

Usage:
  gobuster tftp [flags]

Flags:
  -h, --help               help for tftp
  -s, --server string      The target TFTP server
      --timeout duration   TFTP timeout (default 1s)

Global Flags:
      --delay duration    Time each thread waits between requests (e.g. 1500ms)
      --no-color          Disable color output
      --no-error          Don't display errors
  -z, --no-progress       Don't display progress
  -o, --output string     Output file to write results to (defaults to stdout)
  -p, --pattern string    File containing replacement patterns
  -q, --quiet             Don't print the banner and other noise
  -t, --threads int       Number of concurrent threads (default 10)
  -v, --verbose           Verbose output (errors)
  -w, --wordlist string   Path to the wordlist

Examples

gobuster tftp -s tftp.example.com -w common-filenames.txt

Wordlists via STDIN

Wordlists can be piped into gobuster via stdin by providing a - to the -w option:

hashcat -a 3 --stdout ?l | gobuster dir -u https://mysite.com -w -

Note: If the -w option is specified at the same time as piping from STDIN, an error will be shown and the program will terminate.

Patterns

You can supply pattern files that will be applied to every word from the wordlist. Just place the string {GOBUSTER} in it and this will be replaced with the word. This feature is also handy in s3 mode to pre- or postfix certain patterns.

Caution: Using a big pattern file can cause a lot of request as every pattern is applied to every word in the wordlist.

Example file

{GOBUSTER}Partial
{GOBUSTER}Service
PRE{GOBUSTER}POST
{GOBUSTER}-prod
{GOBUSTER}-dev

Use case in combination with patterns

• Create a custom wordlist for the target containing company names and so on
• Create a pattern file to use for common bucket names.

curl -s --output - https://raw.githubusercontent.com/eth0izzle/bucket-stream/master/permutations/extended.txt | sed -s 's/%s/{GOBUSTER}/' > patterns.txt

• Run gobuster with the custom input. Be sure to turn verbose mode on to see the bucket details

gobuster s3 --wordlist my.custom.wordlist -p patterns.txt -v

Normal sample run goes like this:

PS C:\Users\firefart\Documents\code\gobuster> .\gobuster.exe s3 --wordlist .\wordlist.txt
===============================================================
Gobuster v3.2.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Threads:                 10
[+] Wordlist:                .\wordlist.txt
[+] User Agent:              gobuster/3.2.0
[+] Timeout:                 10s
[+] Maximum files to list:   5
===============================================================
2019/08/12 21:48:16 Starting gobuster in S3 bucket enumeration mode
===============================================================
webmail
hacking
css
img
www
dav
web
localhost
===============================================================
2019/08/12 21:48:17 Finished
===============================================================

Verbose and sample run

PS C:\Users\firefart\Documents\code\gobuster> .\gobuster.exe s3 --wordlist .\wordlist.txt -v
===============================================================
Gobuster v3.2.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Threads:                 10
[+] Wordlist:                .\wordlist.txt
[+] User Agent:              gobuster/3.2.0
[+] Verbose:                 true
[+] Timeout:                 10s
[+] Maximum files to list:   5
===============================================================
2019/08/12 21:49:00 Starting gobuster in S3 bucket enumeration mode
===============================================================
www [Error: All access to this object has been disabled (AllAccessDisabled)]
hacking [Error: Access Denied (AccessDenied)]
css [Error: All access to this object has been disabled (AllAccessDisabled)]
webmail [Error: All access to this object has been disabled (AllAccessDisabled)]
img [Bucket Listing enabled: GodBlessPotomac1.jpg (1236807b), HOMEWORKOUTAUDIO.zip (203908818b), ProductionInfo.xml (11946b), Start of Perpetual Motion Logo-1.mp3 (621821b), addressbook.gif (3115b)]
web [Error: Access Denied (AccessDenied)]
dav [Error: All access to this object has been disabled (AllAccessDisabled)]
localhost [Error: Access Denied (AccessDenied)]
===============================================================
2019/08/12 21:49:01 Finished
===============================================================

Extended sample run

PS C:\Users\firefart\Documents\code\gobuster> .\gobuster.exe s3 --wordlist .\wordlist.txt -e
===============================================================
Gobuster v3.2.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Threads:                 10
[+] Wordlist:                .\wordlist.txt
[+] User Agent:              gobuster/3.2.0
[+] Timeout:                 10s
[+] Expanded:                true
[+] Maximum files to list:   5
===============================================================
2019/08/12 21:48:38 Starting gobuster in S3 bucket enumeration mode
===============================================================
http://css.s3.amazonaws.com/
http://www.s3.amazonaws.com/
http://webmail.s3.amazonaws.com/
http://hacking.s3.amazonaws.com/
http://img.s3.amazonaws.com/
http://web.s3.amazonaws.com/
http://dav.s3.amazonaws.com/
http://localhost.s3.amazonaws.com/
===============================================================
2019/08/12 21:48:38 Finished
===============================================================

gobuster's Issues

Gobuster error on installation in go v1.6 WSL Ubuntu

root in github.com/OJ/gobuster on  master [!] via 🐹 v1.6
•% ➜ ls
libgobuster  LICENSE  main.go  README.md  THANKS

root in github.com/OJ/gobuster on  master [!] via 🐹 v1.6
•% ➜ go get && go build
# github.com/OJ/gobuster/libgobuster
libgobuster/dir.go:108: undefined: uuid.Must
libgobuster/dns.go:13: undefined: uuid.Must

root in github.com/OJ/gobuster on  master [!] via 🐹 v1.6
•% ➜ go install
# github.com/OJ/gobuster/libgobuster
libgobuster/dir.go:108: undefined: uuid.Must
libgobuster/dns.go:13: undefined: uuid.Must

root in github.com/OJ/gobuster on  master [!] via 🐹 v1.6
•% ➜ echo $GOPATH
/root/go

root in github.com/OJ/gobuster on  master [!] via 🐹 v1.6
•% ➜ pwd
/root/go/src/github.com/OJ/gobuster

root in github.com/OJ/gobuster on  master [!] via 🐹 v1.6
•% ➜ go env
GOARCH="amd64"
GOBIN=""
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/root/go"
GORACE=""
GOROOT="/usr/lib/go-1.6"
GOTOOLDIR="/usr/lib/go-1.6/pkg/tool/linux_amd64"
GO15VENDOREXPERIMENT="1"
CC="gcc"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0"
CXX="g++"
CGO_ENABLED="1"

I think all the settings are in place but why this won't work, any help ?

Enhancement Reqeust: Status and Pause/Resume

What is the plausibility of you adding a status hotkey to return where gobuster is currently at in the wordlist and also a pause/resume? Or a switch to start at a specific position in a wordlist?

When following redirects, status codes of discovered pages are incorrectly logged

When running the tool in "dir" mode with "-r" option to follow redirects, status codes of discovered pages are always logged as "OK" (200).

Example:

1. Initial request results in redirect (302)
2. The target of redirection is "Not Found" (404)
   3, The target is logged by gobuster as "OK" (200)

add more than one dictionary? -w?

Hello is there a way to add more than one dictionary? I tried -w dic.txt,dic2.txt also with -w dic.txt -w dict2.txt with no luck
Also recursive in most cases sucks.. but is not to have the option in case is needed...

Validate base domain prior to DNS bruteforcing

When doing DNS brute forcing we don't check to see if the base domain exists first. This means that if someone fat-fingers the base domain, they end up waiting forever only to find nothing will be found.

Instead, an initial request should be made to make sure that the base domain exists, and bail out if it doesn't (much like what we do with URLs).

Out of Memory Issue?

Got this issue a few times today. On OSX with 16GB RAM. Calling gobuster from 10 python processes (also tried with 10 threads) with -t 5 and a 10 word list. Is it possible that there's a memory leak? My code is using only subprocess module functions that wait for the program to end before continuing.

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x1210e58]

goroutine 1 [running]:
main.SetupDir(0xc4200d0140, 0x1010452)
	/Users/me/.go/src/gobuster-master/main.go:563 +0x138
main.Process(0xc4200d0140)
	/Users/me/.go/src/gobuster-master/main.go:433 +0x79
main.main()
	/Users/me/.go/src/gobuster-master/main.go:824 +0x3e

Update: Memory usage shows no signs of climbing out of control before this error happens
5 minutes after last update Update: I think it's just that MakeRequest is returning nil because http.NewRequest is failing.

Add HTTP Size Support for 301/302 Requests

Currently HTTP Response size of Redirects is not displayed, even with the -l flag in Directory Mode. I'm not sure how common it is in the real world, but I've come across several CTF Machines that unintentionally expose PHP Scripts by forgetting to call exit() after HTTP Redirect.

This is the only reason I'd prefer to use DirBuster over the command line alternatives (GoBuster/Dirb). I'd love to recommend GoBuster as its CLI Driven, Faster, and more reliable however I really dislike the lack of response since on the 301/302 requests.

Gobuster seems to stop after ~1100 requests?

Originally I tried pushing it through tor, it stopped with no error message after ~1200 requests.
I tried against my own server not over tor, and it stopped at ~1100.

The wordlist I'm using had ~382,000 items in it, so I'm not sure what's going on..
is there a preferred troubleshooting step you'd like me to follow here?

Saving output

Any plans to include the option to save output?

Add dependency management (dep)

It would be nice to have the (soon to be official) supported package manager integrated.

• https://github.com/golang/dep

Definitely makes things easier when working on new features, and gives better support around managing dependency versions/branches/etc as required.

dep init
dep ensure

Compile error

Hi,

Just had a try of your toy but first compile action gave me an error.

"./main.go:286: undefined: bufio.NewScanner"

Platform: Kali 64 bit.
go compiler installed by using "apt-get install golang"

Any ideas of how that can be resolved?

The NewScanner directive is located only with that line, 286, so I suppose you would know better what's going on at that point.

Thanks.

go get: no install location for directory /opt/gobuster outside GOPATH

When running: sudo go get && go build from /opt/gobuster/ I get the following

go get: no install location for directory /opt/gobuster outside GOPATH
For more details see: 'go help gopath'

Minimize content downloaded for each checked URL

I haven't confirmed this, but the feel I got from looking at the code is that currently gobuster downloads the entire page for each checked URL.

If that is the case, there are a few methods I was thinking of that may help to speed this up:

• Using the range header: https://developer.mozilla.org/en-US/docs/Web/HTTP/Range_requests
• Supporting HEAD/OPTIONS requests (#44)

On the topic of using the range header, it could be that some tests are done at the beginning to see if it is supported (similar to the 'wildcard response found' check) to ensure the server supports ranges.

If there is support for it, gobuster could send the range header to limit the request to a reasonably small size (maybe customizable from flags with a sensible default)

If it's not supported by the server, maybe gobuster could forcibly close the connection after reading X bytes as a fallback.

If there isn't already a timeout set for a connection that 'never returns', that could be implemented in a similar way, again customisable.

There may be other optimisations that could be done in a similar vain to this, but for now, these are the ones coming to mind.

Add 'chomp slash' feature

This is getting into a bit of an edge case territory, so it may not be best solved here.. but I was using one of the SecLists dictionaries and it prefixed the paths with /, which resulted in a // being generated by gobuster, which resulted in redirect behaviour on the website I was testing.

There is currently functionality to append a forward slash, I would see this as being the anti-case for that option.

-f	Append a forward-slash to each directory request (dir mode only)

It could probably be made more generic by allowing to append/chomp an arbitrary string (that defaults to /)

This may be easier (or at least nicer) to integrate into the CLI with #59

I would then see it being something similar to:

--append-slash
--append
--append /

--chomp-slash
--chomp
--chomp /

Edit: Re-reading this.. the current functionality is 'append', whereas I was thinking of 'prepend'. Maybe the current functionality of adding a slash could be controlled with a --prefix or --prepend and the current -f could be controlled with a --suffix or --append type flag.

Add "Y U NO RECURSE" docs to readme

Lots of people want to know why gobuster doesn't support recursion. I need to add my rationale to the README so that I don't have to type it out every time someone asks.

Error: multiple-value uuid.NewV4() in single-value context

While building:

./main.go:535: multiple-value uuid.NewV4() in single-value context
./main.go:560: multiple-value uuid.NewV4() in single-value context

Code refs:

• https://github.com/OJ/gobuster/blob/master/main.go#L535
• https://github.com/OJ/gobuster/blob/master/main.go#L560

Library causing the issue:

• https://github.com/satori/go.uuid

Looks like the usage has changed to supply an error value in the return as well, eg:

u, err := uuid.NewV4()

This seems to be the change that caused it:

• satori/go.uuid@0ef6afb

If the dependencies were pinned to known working versions (#61), errors like this shouldn't come up.

Follows redirects by default.

When I request a resource using curl the server responds with a 302 redirection. Requesting the same resource with gobuster gives a 200 response.

Detect/report on redirect loops

Currently, if a redirect loop is hit while using -r then gobuster spins a few times, then returns the following (at least if it's on the initial/base URL):

[-] Unable to connect: https://example.com/somepath/

gobuster/main.go

Line 412 in 7a6d1c0

fmt.Println("[-] Unable to connect:", s.Url)

Looking at my logs, the server is redirecting like so:

301 https://example.com/somepath/
301 https://example.com/somepath
301 https://example.com/somepath/
..etc..

Obviously, if we don't follow redirects with -r this issue won't happen.

This would be interesting to detect on, because in this instance, a non-existent folder will redirect to a 404, whereas an existing folder will enter this redirect loop.

Enhancement: Add IP Resolution to Sub Domain Output

Hey @OJ,

Working through some automated OSINT parsing and noticed one drawback to gobuster being a lack of IP resolution for the discovered sub domains.

Super obvious example:
Found: mail.domain.com - 42.1.1.2

Cheers

Add support for zone transfers and wildcard domains

With the new DNS feature we currently blindly brute force the DNS names in the word list to see what resolves. This is a pointless exercise when:

• Wildcard records are in use.
• Zone transfers are possible.

We should cater for both of these prior to running the brute force, and exit early if needs be. This is effectively what fierce does.

Split main.go to subpackages

Hey there!
@OJ what you think about splitting gobuster's single main.go file to subpackages? Won't it make project maintaining, mean adding new features, writing tests and merging things easier? Is there any reason to keep gobuster as one big file?
Thank you for an amazing tool, cheers.

Add "page length" support

Add an option that will change the display to include the full length of the returned result (in bytes). This could be done via the Content-Length header or via parsing the page directly.

Rework CLI into cobra

While it might add a slight bit more size to the binary, I think the flexibility/ease of implementation we can get from using a more full featured CLI would be pretty sweet.

https://github.com/spf13/cobra is used by a huge number of go projects, and is really nice to work with from my little experience.

I think this could work into the stuff already landing (referenced from #55) with the refactor, and make a nice little rework for 1.4.

Would you be open to it @OJ ?

Gobuster pre-pending http:// when -u designation specifies an alternate port

So, I looked to see if this was already addressed but didn't seem to be. Hope this was not an oversight on my end...

I am currently writing a script that, based off of nmap output will send the standard 80/443 port designation as well as any proxied http/https designations (i.e. 8080 or 8443) to gobuster. However, even when using gobuster -u syntax I receive this error:

Gobuster v1.2                OJ Reeves (@TheColonial)
=====================================================
[-] Unable to connect: http://10.10.10.10:443/

I was curious if there was a way to force gobuster to take the http:// or https:// off and still have it query the URI by just navigating 10.10.10.10:443/dirtest/ or 10.10.10.10:10000/dirtest/, etc....

I realize this might cause issues with certain web technologies, where it requires the http:// or https:// designation - so I'm starting to wonder if maybe it's my script that's causing this...

Potential third mode: mixed

I was thinking how neat it would be if you could have a third brute mode (mixed?) that combined the dns and directory brute. Just a thought but something like you pass a main top level domain, dns wordlist, and a web dir/file list. Then as gobuster discovers subdomains it kicks off a web dir brute, maybe after a quick check for port 80/443. I could have a go at working up a pull request for this if you like...

Docker

Was just wondering, if I knocked together a quick little Dockerfile and maybe a run script or two, would you be open to merging it?

[IDEA] Add response size

###################

Use contexts to handle termination

I noticed that you were using a boolean for the termination in state:

https://github.com/OJ/gobuster/blob/1.4-dev/libgobuster/state.go#L69

Have you considered using contexts instead?

https://golang.org/pkg/context/

An example is in the implementation I did based on your library.

The thread which receives the "Done" message:
https://github.com/kkirsche/gbust/blob/master/libgbust/worker.go#L18

The main context creation. The cancel is a context.CancelFunc which allows you to tell everything using it to "finish" what it's doing:
https://github.com/kkirsche/gbust/blob/master/libgbust/attacker.go#L74

Completion Percentage PLEASE! <3

Please, this program is awesome, but it miss a completion percentage! Please <3

Add "grep" support for web pages

It'd be handy to add a "grep" like feature that let's the users filter the results based on pages that have certain content. For example, if you're interested in pages that return a 200 status code that also have the word login in them.

Add support for network interface selection

Hi,

it would be great to have a command switch to specify which interface gobuster uses for scanning.

Show destination when 'wildcard response found'

Currently when a wildcard response is found it looks something like this:

[-] Wildcard response found: https://example.com/47ebafdb-032d-4a47-bf41-26b1a4314326 => 302

It would be useful if the destination URL was shown as well, maybe something like:

[-] Wildcard response found: https://example.com/47ebafdb-032d-4a47-bf41-26b1a4314326 => 302 => https://example.com/foo

This comes from:

gobuster/main.go

Line 565 in 7a6d1c0

fmt.Println("[-] Wildcard response found:", fmt.Sprintf("%s%s", s.Url, guid), "=>", *wildcardResp)

Currently GoGet appears to just be returning the status code and content size, so changes would need to be made there, and to MakeRequest

gobuster/main.go

Lines 228 to 230 in 7a6d1c0

	func GoGet(s *State, url, uri, cookie string) (*int, *int64) {
	return MakeRequest(s, url+uri, cookie)
	}

gobuster/main.go

Line 223 in 7a6d1c0

return &resp.StatusCode, length

Handling of the CTRL+C signal is not consistent across platforms

I'm seeing this behave strangely in different contexts, and so I might just remove it until I figure out what is going on. OSX seems to be the strangest.

Canary to filter DNS Addresses

Don't kill me...

would there be any value in adding a canary?
random string or user supplied...

If the target resolves every name provided in the list those that have the same IP as the canary domain automatically get stripped out , suppressed,hidden whatnot

should add option to scan robots.txt

Cannot Find Package

root@karma:~/pt/gobuster# go run main.go 
main.go:23:2: cannot find package "github.com/OJ/gobuster/libgobuster" in any of:
	/usr/lib/go-1.9/src/github.com/OJ/gobuster/libgobuster (from $GOROOT)
	/root/go/src/github.com/OJ/gobuster/libgobuster (from $GOPATH)

Tried reinstalling GO (sudo apt-purge remove) but can't make it work please help

stdin detection fails to detect pipes vs. redirected stdin in various situations

Hello! Great tool!

I've come across a couple of situations where the stdin detection breaks.

The first situation is: gobuster works using < filename style IO redirection:

▶ gobuster -u "https://www.google.com/" -q < wordlist.txt
/robots.txt (Status: 200)

But not if the input comes from a pipe:

▶ cat wordlist.txt | gobuster -u "https://www.google.com/" -q
1 error occurred:

* [!] WordList (-w): Must be specified

The second situation is kind of the reverse. When in a bash while loop fed using IO redirection, and a wordlist is specified with -w, gobuster erroneously attempts to read the wordlist from the file being fed to the while loop and fails:

▶ while read url; do gobuster -u "$url" -q -w wordlist.txt; done < urls.txt
1 error occurred:

* [!] Wordlist (-w) specified with pipe from stdin. Can't have both!

This doesn't happen when the while loop is being fed with a pipe (because the size of the stdin device is zero, which is checked for here):

▶ cat urls.txt | while read url; do gobuster -u "$url" -q -w wordlist.txt; done
/robots.txt (Status: 200)

I think this is a difficult problem to tackle because of the various different permutations in which the tool can be run. One option is to avoid doing stdin detection at all, and allow people to specify -w - to force reading the wordlist from stdin; it's not something that is without precedent, but it does add a little something extra for the user.

Another option is to always use a wordlist if one is specified with -w, and only attempt to read from stdin if none is specified. This option has the downside that the command will hang if the user forgets the -w option but provides no words on stdin.

Progress Bar Feature & Verbose Resume

Hello!
I find this tool pretty good, so well done!
There are two features that if you could add, it would help a lot.

• Having a progress bar/percentage status would be good. For very big wordlists, the user doesnt have a way to know how far the scanning is from the end.
• When using verbose mode, the tool should save in a dictionary for example, all requests with relevant status codes, and print them in the end. So one doesnt have to scroll over the screen to find relevant status.

Also, tell me what you think of these.
Thank you.

Add support to ignore invalid HTTPS certificates

At the moment, gobuster indicates that it can't connect to sites if they don't have valid certs. This needs to be sorted.

How fantasical would it be for a target list include ?

VERY fantastical.

Is it possible to have a list of target addresses (such as nmap's -iL)

I'll buy you steak next time your in London -_-

no I/O exception handling

When webserver block gobuster from brute forcing files, gobuster doesn't have the proper I/O exception handling and will just hang forever.

even if you ctr+c to interrupt it won't respond

Add recursive option

Hi, thanks for your work.!

It would be really nice to have an option for recursive scan when looking for folders so I don't have to do it manually.

So when you have something like :
http://foo/foophones/category
http://foo/foophones/images

You could also find out the following with the new function
http://foo/foophones/images/products
http://foo/foophones/images/avatars

Thanks.

Where is executable?

Is it compiled or what?

Add support to deal with wildcard dns

Add in logic to send a couple random subdomain resolution requests and if they are the same IP ignore responses with that IP for future requests. I think fierce does something similar...

Add in the README.txt to export GOBIN env

http://stackoverflow.com/questions/18149601/go-install-always-fails-no-install-directory-outside-gopath
mkdir bin
export GOBIN=$GOPATH/bin

Add JSON Output Feature

Hi,
First of all congratulations for building such an awesome tool. I mean it's damn fast and does the work nicely.
I though it would be nice for gobuster to have a JSON output flag which would allow us to output the results in JSON format. This would allow for integration of gobuster in automated scripts.
The current output format is not well enough for integration in automated scripts.

Thanks

Add support for batch processing

I usually run gobuster on a set of urls, but gobuster does not natively support this. My solution is to script a loop around it:

cat list-of-targets.txt | while read line; do gobuster .... -u "$line" ; done

That's a bit ugly imho.

Passing the file directly to gobuster seems a much more efficient and clean way to do it. Maybe something like nmap's -iL list-of-targets.txt?

I'll have a look at the code and try to implement something.

Milestones to 1.4

Instead of cluttering up #41 with unrelated stuff.. was just wondering, what you're hoping/wanting to land for 1.4?

All of the current stuff in #41 / #51 / #54 seem to be landing in the 1.4-dev branch currently (mostly tagging to track everything back to this issue)

Add support for dir "wildcard" detection

Hi,

I noticed that a few times webservers are configured to return 200s or 301s instead of 404s. That means that gobuster will happily "find" the whole words.txt.

Idea: Count the "valid" hits in a row and if it exceeds 5% or 10% of the whole words.txt, then abort the scan (and/or add an "force" switch).

Kind regards,
gehaxelt

I think I may have found an issue...

Its likely with how you're parsing what's legitimately a real page, what is a 404 and what happens when a site confuses the two.

www.whoismrrobot.com, for example, doesn't have a 404 - it redirects anything that would be a 404 back to the main page, so you get this as a result:

=====================================================
Gobuster v0.8 (DIR support by OJ Reeves @TheColonial)
              (DNS support by Peleus     @0x42424242)
=====================================================
[+] Mode         : dir
[+] Url/Domain   : http://www.whoismrrobot.com/
[+] Threads      : 10
[+] Wordlist     : list.txt
[+] Status codes : 200,204,301,302,307
=====================================================
/A (200)
/about-us (200)
/aboutus (200)
/acceso (200)
/academics (200)
/abstract (200)
/aboutUs (200)
/about_us (200)
/AboutUs (200)
/About (200)
/accesswatch (200)
/accessories (200)
/action (200)
/accounts (200)
/acciones (200)
/activities (200)
/active (200)
/accessibility (200)
/ad (200)
/adclick (200)
/adlog (200)
/admcgi (200)
/admin-bak (200)
/adm (200)
/admin-old (200)
/admin-console (200)
/admin.back (200)
/add (200)```