tools

Overview

GoBuster is a brute-force enumeration tool used for reconnaissance. It enumerates web directories, DNS subdomains, virtual hosts, Amazon S3 buckets, and Google Cloud Storage by brute-forcing with wordlists. A go-to tool for the early recon phase of a CTF or engagement.

Target / Context

Web servers, DNS infrastructure, and cloud storage. Key distinction for HTB and CTF use:

  • DNS mode — enumerates subdomains across multiple machines tied to a domain
  • VHost mode — enumerates virtual hosts running on a single machine/IP (use this for single-target HTB boxes)

DNS vs Vhosts Different Use Cases

Installation

ℹ︎Installation Commands:

See https://github.com/OJ/gobuster for installation instructions.

Basic Usage

ℹ︎Basic Usage: 
gobuster [command] -u "http://target.thm" -w /path/to/wordlist

SecLists Common Directories is recommended as a wordlist.

Flags & Options

ℹ︎Global Flags & Options:
FlagDescriptionExample
-uTarget URL-u “http://example.thm”
-wWordlist path-w /usr/share/wordlists/…
-tNumber of threads (default 10)-t 50
-oWrite results to file-o results.txt
—delayTime to wait between requests—delay 500ms
—debugTroubleshoot errors—debug

Common Use Cases

Directory Enumeration

Brute-force directories and files on a web server.

ℹ︎Commands: 
gobuster dir --help
gobuster dir -u "http://www.example.thm" -w /usr/share/wordlists/dirbuster/... -r
gobuster dir -u "https://example.thm" -w /usr/share/wordlists/... -x .php,.js
ℹ︎Dir Flags:
FlagDescriptionExample
-cCookie to pass with each request-c “session=abc123”
-xFile extensions to scan for-x .php,.js
-HCustom header to pass with each request-H “Authorization: Bearer token”
-kSkip TLS certificate check (CTF/self-signed certs)-k
-PPassword for authenticated requests-P password
-UUsername for authenticated requests-U admin
-sStatus codes to display-s 200,301
-bStatus codes to exclude-b 404,403
-rFollow redirects-r

DNS Subdomain Enumeration

Enumerate subdomains by combining a domain with wordlist entries and performing DNS lookups. Example output: blog.example.thm, shop.example.thm

ℹ︎Commands: 
gobuster dns --help
gobuster dns -d example.thm -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt
ℹ︎DNS Flags:
FlagDescriptionExample
-dDomain to enumerate-d example.thm
-cShow CNAME records (cannot use with -i)-c
-iShow IP addresses the domain resolves to-i
-rCustom DNS server for resolving-r 8.8.8.8

VHost Enumeration

Enumerate virtual hosts running on the same machine. Use this for single-IP HTB targets. Virtual hosts are IP-based and run on the same server — unlike DNS subdomains which may point to different machines.

ℹ︎Commands: 
gobuster vhost --help
gobuster vhost -u "http://10.10.120.125" --domain example.thm -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain --exclude-length 250-320

Note: If you omit —append-domain results will be blog.thm instead of blog.example.thm

ℹ︎/etc/hosts Workflow:

When to add to /etc/hosts before scanning:

  • If using a hostname as the base URL (-u http://example.thm): your system needs to resolve it, so add it first
  • If using an IP as the base URL (-u http://10.10.10.1): gobuster connects directly to the IP — no /etc/hosts entry needed for the scan
  • Recommendation: always use the IP as the base URL for VHost scans; specify the domain separately with —domain

After finding a VHost:

  • Add the discovered VHost to /etc/hosts to browse it in your browser
echo "10.10.10.1   found-vhost.example.thm" | sudo tee -a /etc/hosts
  • The discovered VHost will return a different response only if the web server has a corresponding VHost configuration
ℹ︎VHost Flags:
FlagDescriptionExample
-uBase URL (use IP for HTB)-u “http://10.10.10.1”
—domainAppends domain to each wordlist entry—domain example.thm
—append-domainForms full hostname: word.example.thm—append-domain
—exclude-lengthExclude responses by body length—exclude-length 250-320
-mHTTP method to use-m POST
-rFollow HTTP redirects-r

References / Images