GOBUSTER(1)

📦
version 3.8.2 · 4 versions
, in ubuntu resolute, ubuntu stonking

💅 GOBUSTER(1) — the girlies' guide to brute-forcing ✨

okay so. bestie. you're looking at gobuster, section 1 of the manual, and honestly? it's giving legendary. it's a directory/file, DNS and virtual host brute-forcing tool written in Go 🦋. Go. The language. Not the verb. (although. both.)

🌸 NAME 🌸

gobuster — directory/file, DNS and virtual host brute-forcing tool, written in Go. no cap, that's the whole vibe.

✨ SYNOPSIS ✨

Modes — pick your fighter 👑

  • dir — enumerate directories and files on web servers
  • dns — discover subdomains through DNS resolution
  • s3 — enumerate Amazon S3 buckets
  • gcs — enumerate Google Cloud Storage buckets
  • vhost — discover virtual hosts on web servers
  • fuzz — custom fuzzing with the FUZZ keyword
  • tftp — enumerate files on TFTP servers

Usage:

gobuster help
gobuster help <mode>
gobuster dir <flags>
gobuster dns <flags>
gobuster s3 <flags>
gobuster gcs <flags>
gobuster vhost <flags>
gobuster fuzz <flags>
gobuster tftp <flags>

💖 DESCRIPTION 💖

so gobuster is a high-performance tool and what it does is brute-force, like, a LOT of things:

  • URIs (that's directories and files) on web sites
  • DNS subdomains (with wildcard support, yes she does it all 💅)
  • Virtual Host names on target web servers
  • Open Amazon S3 buckets
  • Open Google Cloud buckets
  • and TFTP servers

it's lowkey made for pentesters, ethical hackers and forensics experts. also it can be used for security tests. main character energy, genuinely.

🎀 OPTIONS 🎀

Global Flags 🌈

  • --delay duration — how long each thread waits between requests (e.g. 1500ms). patience is a virtue, bestie.
  • --no-color — disables color output. sad beige gobuster for sad beige people 🥲
  • --no-error — don't display errors. (we're pretending everything's fine ✨)
  • -z, --no-progress — don't display progress. no progress bar, just vibes.
  • -o, --output string — output file to write results to (defaults to stdout). so like, if you don't specify, it just yells into your terminal. iconic.
  • -p, --pattern string — file containing replacement patterns
  • -q, --quiet — don't print the banner and other noise. hush mode 🤫
  • -t, --threads int — number of concurrent threads (default 10). more threads = more chaos, choose wisely
  • --timeout duration — HTTP timeout (default 10s)
  • -v, --verbose — verbose output (errors). she's telling you EVERYTHING.
  • -w, --wordlist string — path to the wordlist. your bible. your lifeline. 🫶

🔥 EXAMPLES 🔥

Directory Mode:

gobuster dir -u https://example.com -w wordlist.txt -x php,html,js

DNS Mode (Subdomain Discovery):

gobuster dns -do example.com -w wordlist.txt -t 50

Virtual Host Mode:

gobuster vhost -u https://example.com --append-domain -w wordlist.txt

Cloud Storage (S3/GCS):

gobuster s3 -w bucket-names.txt

gobuster gcs -w bucket-names.txt

Fuzzing Mode:

gobuster fuzz -u https://example.com?FUZZ=test -w wordlist.txt

TFTP Mode:

gobuster tftp -s 10.0.0.1 -w wordlist.txt

🙈 BUGS 🙈

found a bug? first of all, relatable. second of all, open an issue at https://github.com/OJ/gobuster/issues/new. alternatively, if you're a Debian user, you can open a bug using the reportbug tool. slay 💀

👑 AUTHOR 👑

gobuster was written by OJ Reeves (@TheColonial) <oj@buffered.io> and Christian Mehlmauer (@firefart) <firefart@firefart.at>. legends, fr fr.

this manual page was written by Thiago Andrade Marques <andrade@debian.org> for the Debian project (but may be used by others). 🫶

okay that's the whole page bestie, no notes. this is gobuster-3.8.2, dated 04 January 2026 — so go forth, run your scans responsibly, and remember: only brute-force stuff you're actually allowed to brute-force. periodt. 💖✨🎀

📦 where this page comes from