E-GOB
Gobuster
Directory, DNS, and vhost brute-forcing against web targets.
OVERVIEW
Gobuster brute-forces three things via wordlists: paths and files on a web server (dir mode), virtual host names on a shared IP (vhost mode), and subdomains via DNS resolution (dns mode). It's fast because it's written in Go and parallelizes requests.
It doesn't understand the application the way Burp does: it just fires the wordlist and reports which responses break the expected pattern (by status code or size), so filtering false positives is on the analyst.
USE CASES
Practical use cases
- 01
Finding admin panels or endpoints not linked from the public site.
- 02
Confirming additional vhosts served from the same IP as the main target.
- 03
Complementing passive subdomain discovery with active DNS brute-forcing.
- 04
Spotting forgotten backups, config files, or dev paths.
QUICK START
Once a web host is confirmed, to surface paths, vhosts, or subdomains that passive mapping missed.
- Pick a wordlist that matches the app type (generic, CMS-specific, extension-based).
- Run one manual baseline request first to know the real 404 behavior.
- Run dir mode against the confirmed host with a reasonable thread count.
- Filter by status code and response size before treating anything as a hit.
root@itspentest:~# gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt -t 30BEFORE YOU RUN IT
What to check before running it
Large wordlists with many threads can saturate the WAF or trigger IP bans.
Sites with "soft 404s" (200 status on error pages) produce false positives unless filtering is configured correctly.
It doesn't replace manual app review: it only points to where to look next.