loading
Loading content
loading
Discovery
Directory and file brute force against a live web target.
overview
After a prober confirms a host is live, wire -u and -w into gobuster dir. It requests each wordlist path and writes matching directories and files to a file and folder for the next probe or test stage.
Reach for it when you need unlinked content: admin panels, backups, config files, and endpoints the app never links. Tune hits with -s or -b, append -x for extensions such as php or bak, and add -l when body length helps separate soft-404s from real pages.
ffuf and feroxbuster cover richer filtering, recursion, or parameter and vhost modes. gobuster dir stays a focused path brute forcer. Trickest hosts it as a managed Discovery node.
source github.com/OJ/gobuster
use cases
Brute-force a live host with a content wordlist to surface admin pages, backups, and endpoints that are not referenced anywhere on the site.
Append extensions like php, bak, or zip to each word so the run also looks for source, backup, and archive files behind known paths.
Tune the positive or blacklisted status codes and include the body length so soft-404s and boilerplate pages do not flood the results.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | The target URL to brute-force. |
| wordlist | FILE | -w | Wordlist of paths to request against the target. |
| extensions | STRING | -x | File extension(s) to append to each word, e.g. php,bak,zip. |
| threads | STRING | -t | Number of concurrent threads (default 10). |
| positive-status-codes | STRING | -s | Status codes counted as hits (default 200,204,301,302,307,401,403). |
| blacklist-status-codes | STRING | -b | Status codes to drop; overrides the positive list when set. |
| no-tls-validation | BOOLEAN | --no-tls-validation | Skip TLS certificate verification for self-signed or expired certs. |
| useragent | STRING | -a | Set the User-Agent string (default gobuster/3.1.0). |
Showing key inputs. gobuster-dir exposes 19 inputs in total.
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | -u | The target URL |
| proxy | STRING | -p | Proxy to use for requests [http(s)://host:port] |
| cookies | STRING | -c | Cookies to use for the requests |
| headers | STRING | -H | Specify HTTP headers, -H 'Header1: val1' -H 'Header2: val2' |
| threads | STRING | -t | Number of concurrent threads (default 10) |
| timeout | STRING | --timeout | HTTP Timeout (default 10s) |
| wordlist | FILE | -w | Provide a wordlist |
| add-slash | BOOLEAN | -f | Append / to each request |
| useragent | STRING | -a | Set the User-Agent string (default "gobuster/3.1.0") |
| extensions | STRING | -x | File extension(s) to search for |
| expanded-mode | BOOLEAN | -e | Expanded mode, print full URLs |
| include-length | BOOLEAN | -l | Include the length of the body in the output |
| follow-redirect | BOOLEAN | -r | Follow redirects |
| no-tls-validation | BOOLEAN | --no-tls-validation | Skip TLS certificate verification |
| basic-auth-password | STRING | -P | Password for Basic Auth |
| basic-auth-username | STRING | -U | Username for Basic Auth |
| positive-status-codes | STRING | -s | Positive status codes (will be overwritten with status-codes-blacklist if set) (default "200,204,301,302,307,401,403") |
| blacklist-status-codes | STRING | -b | Negative status codes (will override status-codes if set) |
| force-continued-wildcard | BOOLEAN | --wildcard | Force continued operation when wildcard found |
example
# brute-force directories and files, show body lengthgobuster dir -u https://example.com -w /wordlists/common.txt -x php,bak -t 50 -l/.htaccess (Status: 403) [Size: 278]/admin (Status: 301) [Size: 315] [--> https://example.com/admin/]/backup (Status: 301) [Size: 316] [--> https://example.com/backup/]/config.php (Status: 200) [Size: 0]/index.php (Status: 200) [Size: 10842]/login (Status: 200) [Size: 4210]/robots.txt (Status: 200) [Size: 142]/server-status (Status: 403) [Size: 300]/uploads (Status: 301) [Size: 317] [--> https://example.com/uploads/]guidance
Use gobuster-dir to brute-force directories and files on a host you already know is live. Prefer it for straightforward -u/-w content discovery. Reach for ffuf or feroxbuster when you need richer filtering, recursion, or parameter and vhost fuzzing.
General FUZZ engine with richer response filtering plus parameter and vhost modes. Prefer when path brute force is only one of several fuzz jobs.
Recursive content discovery with smart defaults. Prefer when you want automatic walks into directories it finds.
Python directory brute-forcer with built-in extension handling and recursion. Close peer for classic content discovery.
faq
related
Extract URLs and endpoints from Android APK files.
Web path scanner.
Crawl pages, harvest potential parameters, write a custom wordlist.
Recursive content discovery with smart defaults and rich response filters.
Maintained gau fork for passive archive URL collection.
Extract JavaScript file URLs from a page or URL list.
A target URL and a wordlist feed gobuster-dir, which brute-forces paths and writes the directories and files it discovers as a queryable output.
Facts on this page come from the live Trickest tool library.