Discovery
gobuster dir: find hidden directories and files
Directory and file brute force against a live web target.
overview
What gobuster-dir does
After a prober confirms a host is live, wire -u and -w into gobuster dir. It requests each wordlist path and writes matching directories and files to a file and folder for the next probe or test stage.
Reach for it when you need unlinked content: admin panels, backups, config files, and endpoints the app never links. Tune hits with -s or -b, append -x for extensions such as php or bak, and add -l when body length helps separate soft-404s from real pages.
ffuf and feroxbuster cover richer filtering, recursion, or parameter and vhost modes. gobuster dir stays a focused path brute forcer. Trickest hosts it as a managed Discovery node.
source github.com/OJ/gobuster
use cases
Where gobuster-dir fits
Discover unlinked directories and files
Brute-force a live host with a content wordlist to surface admin pages, backups, and endpoints that are not referenced anywhere on the site.
Hunt files by extension
Append extensions like php, bak, or zip to each word so the run also looks for source, backup, and archive files behind known paths.
Filter responses to cut noise
Tune the positive or blacklisted status codes and include the body length so soft-404s and boilerplate pages do not flood the results.
reference
gobuster-dir inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | The target URL to brute-force. |
| wordlist | FILE | -w | Wordlist of paths to request against the target. |
| extensions | STRING | -x | File extension(s) to append to each word, e.g. php,bak,zip. |
| threads | STRING | -t | Number of concurrent threads (default 10). |
| positive-status-codes | STRING | -s | Status codes counted as hits (default 200,204,301,302,307,401,403). |
| blacklist-status-codes | STRING | -b | Status codes to drop; overrides the positive list when set. |
| no-tls-validation | BOOLEAN | --no-tls-validation | Skip TLS certificate verification for self-signed or expired certs. |
| useragent | STRING | -a | Set the User-Agent string (default gobuster/3.1.0). |
Showing key inputs. gobuster-dir exposes 19 inputs in total.
Full flag reference (19 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | The target URL |
| proxy | STRING | -p | Proxy to use for requests [http(s)://host:port] |
| cookies | STRING | -c | Cookies to use for the requests |
| headers | STRING | -H | Specify HTTP headers, -H 'Header1: val1' -H 'Header2: val2' |
| threads | STRING | -t | Number of concurrent threads (default 10) |
| timeout | STRING | --timeout | HTTP Timeout (default 10s) |
| wordlist | FILE | -w | Provide a wordlist |
| add-slash | BOOLEAN | -f | Append / to each request |
| useragent | STRING | -a | Set the User-Agent string (default "gobuster/3.1.0") |
| extensions | STRING | -x | File extension(s) to search for |
| expanded-mode | BOOLEAN | -e | Expanded mode, print full URLs |
| include-length | BOOLEAN | -l | Include the length of the body in the output |
| follow-redirect | BOOLEAN | -r | Follow redirects |
| no-tls-validation | BOOLEAN | --no-tls-validation | Skip TLS certificate verification |
| basic-auth-password | STRING | -P | Password for Basic Auth |
| basic-auth-username | STRING | -U | Username for Basic Auth |
| positive-status-codes | STRING | -s | Positive status codes (will be overwritten with status-codes-blacklist if set) (default "200,204,301,302,307,401,403") |
| blacklist-status-codes | STRING | -b | Negative status codes (will override status-codes if set) |
| force-continued-wildcard | BOOLEAN | --wildcard | Force continued operation when wildcard found |
example
Run gobuster-dir
# brute-force directories and files, show body lengthgobuster dir -u https://example.com -w /wordlists/common.txt -x php,bak -t 50 -l/.htaccess (Status: 403) [Size: 278]/admin (Status: 301) [Size: 315] [--> https://example.com/admin/]/backup (Status: 301) [Size: 316] [--> https://example.com/backup/]/config.php (Status: 200) [Size: 0]/index.php (Status: 200) [Size: 10842]/login (Status: 200) [Size: 4210]/robots.txt (Status: 200) [Size: 142]/server-status (Status: 403) [Size: 300]/uploads (Status: 301) [Size: 317] [--> https://example.com/uploads/]guidance
Choosing gobuster-dir
Use gobuster-dir to brute-force directories and files on a host you already know is live. Prefer it for straightforward -u/-w content discovery. Reach for ffuf or feroxbuster when you need richer filtering, recursion, or parameter and vhost fuzzing.
ffuf
General FUZZ engine with richer response filtering plus parameter and vhost modes. Prefer when path brute force is only one of several fuzz jobs.
feroxbuster
Recursive content discovery with smart defaults. Prefer when you want automatic walks into directories it finds.
dirsearch
Python directory brute-forcer with built-in extension handling and recursion. Close peer for classic content discovery.
faq
gobuster-dir questions
related
More Discovery tools
apkurlgrep
Extract URLs and endpoints from Android APK files.
cariddi
Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.
crawlergo
Browser-driven crawler that harvests requests for downstream scanners.
dirsearch
Web path scanner.
fallparams
Crawl pages, harvest potential parameters, write a custom wordlist.
feroxbuster
Recursive content discovery with smart defaults and rich response filters.
Run gobuster-dir yourself
A target URL and a wordlist feed gobuster-dir, which brute-forces paths and writes the directories and files it discovers as a queryable output.
Facts on this page come from the live Trickest tool library.