wordlist /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt

Gobuster Cheat Sheet¶

Initial GoBuster Directory Scan¶

gobuster dir -u <target_url> -w <wordlist> -t 50 | tee gobuster_output.txt

- dir: This option specifies that we want to perform directory enumeration. - -u : This option specifies the target URL or IP address where the directory enumeration will be performed. Replace with the actual URL or IP address of the target. - -w <wordlist>: This option specifies the wordlist file to be used for brute-forcing directories. Gobuster will use the words from this file to construct and test directory paths. - -t 50: This option specifies the concurrency level, i.e., the number of concurrent threads to use during the scan. In this case, it's set to 50, meaning Gobuster will use 50 concurrent threads to perform directory enumeration. This can help speed up the scan by sending multiple requests simultaneously. - | tee gobuster_output.txt: This part of the command uses the tee command to redirect the output of gobuster to both the specified output file (gobuster_output.txt) and the screen. The tee command copies input from standard input and sends it to both standard output and the specified file.

Beginner Concepts¶

Basic Usage¶

# Basic Usage
gobuster dir -u <target_url> -w <wordlist>

# Directory/File Enumeration
gobuster dir -u <target_url> -w <wordlist>

# Recursive Scanning
gobuster dir -u <target_url> -w <wordlist> -r

# Extension Enumeration
gobuster dir -u <target_url> -w <wordlist> -x <extensions>

# Wildcard Responses
gobuster dir -u <target_url> -w <wordlist> -z

Intermediate Concepts¶

# Custom Headers
gobuster dir -u <target_url> -w <wordlist> -H "Header: Value"

# Authorization
gobuster dir -u <target_url> -w <wordlist> -x <extensions> -U <username> -P <password>

# Output Formatting
gobuster dir -u <target_url> -w <wordlist> -o <output_file>

# Status Codes
gobuster dir -u <target_url> -w <wordlist> -s <status_codes>

# URL Encoding
gobuster dir -u <target_url> -w <wordlist> -e

# User-Agent Spoofing
gobuster dir -u <target_url> -w <wordlist> -a "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

# Timeout
gobuster dir -u <target_url> -w <wordlist> -t <timeout>