Brute-force web directories and files with gobuster dir

gobuster dir mode aims a wordlist at a web server and requests every path in turn, reporting the ones the server answers. Written in Go, it is fast enough to throw a large list at a host and still finish quickly, which is why it is a staple for turning up admin panels, backups, config files, and endpoints the application never links to.

You decide what counts as a hit. Keep the default positive status codes or narrow them with -s, drop noise with a -b blacklist, and add -l to print the body length so a soft-404 stands out from a real page. -x appends extensions such as php or bak so a run hunts files as well as directories, and -H, -c, -a, -U with -P, and --no-tls-validation let it reach targets behind custom headers, cookies, a set user agent, basic auth, or a self-signed certificate.

In a Trickest workflow it slots in after a prober confirms a host is live: wire a URL and a wordlist into the node and it writes the discovered paths to a file and a folder that the next probing or testing stage reads. Schedule it and each run re-checks the surface for content that appeared since the last pass.