Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Oct 13, 2026

Discovery

gobuster dir: find hidden directories and files

gobuster dir is the directory and file enumeration mode of Gobuster, a Go brute-forcing tool that requests each wordlist entry against a web server URL and reports the paths whose responses pass its status-code filters.

installgo install github.com/OJ/gobuster/v3@latest

Go · Apache-2.0 license

Agent
Discover unlinked directories and filesHunt files by extensionFilter responses to cut noise

overview

What gobuster-dir does

After a prober confirms a host is live, wire -u and -w into gobuster dir. It requests each wordlist path and writes matching directories and files to a file and folder for the next probe or test stage.

Reach for it when you need unlinked content: admin panels, backups, config files, and endpoints the app never links. Tune hits with -s or -b, append -x for extensions such as php or bak, and use --exclude-length to drop soft-404 pages that share one body size.

ffuf and feroxbuster cover richer filtering, recursion, or parameter and vhost modes. gobuster dir stays a focused path brute forcer. Trickest hosts it as a managed Discovery node.

source github.com/OJ/gobuster

use cases

Where gobuster-dir fits

Discover unlinked directories and files

Brute-force a live host with a content wordlist to surface admin pages, backups, and endpoints that are not referenced anywhere on the site.

Hunt files by extension

Append extensions like php, bak, or zip to each word so the run also looks for source, backup, and archive files behind known paths.

Filter responses to cut noise

Tune the positive or blacklisted status codes and include the body length so soft-404s and boilerplate pages do not flood the results.

reference

gobuster-dir inputs and flags

19 inputs
NameTypeFlagDescription
urlSTRING-uThe target URL to brute-force.
wordlistFILE-wWordlist of paths to request against the target.
extensionsSTRING-xFile extension(s) to append to each word, e.g. php,bak,zip.
threadsSTRING-tNumber of concurrent threads (default 10).
positive-status-codesSTRING-sStatus codes counted as hits. Empty by default: gobuster drops 404s through -b instead.
blacklist-status-codesSTRING-bStatus codes to drop; overrides the positive list when set.
no-tls-validationBOOLEAN--no-tls-validationSkip TLS certificate verification for self-signed or expired certs.
useragentSTRING-aSet the User-Agent string (default gobuster/3.1.0).

Showing key inputs. gobuster-dir exposes 19 inputs in total.

Full flag reference (19 inputs)
NameTypeFlagDescription
urlSTRING-uThe target URL
proxySTRING-pProxy to use for requests [http(s)://host:port]
cookiesSTRING-cCookies to use for the requests
headersSTRING-HSpecify HTTP headers, -H 'Header1: val1' -H 'Header2: val2'
threadsSTRING-tNumber of concurrent threads (default 10)
timeoutSTRING--timeoutHTTP Timeout (default 10s)
wordlistFILE-wProvide a wordlist
add-slashBOOLEAN-fAppend / to each request
useragentSTRING-aSet the User-Agent string (default "gobuster/3.1.0")
extensionsSTRING-xFile extension(s) to search for
expanded-modeBOOLEAN-eExpanded mode, print full URLs
include-lengthBOOLEAN-lInclude the length of the body in the output
follow-redirectBOOLEAN-rFollow redirects
no-tls-validationBOOLEAN--no-tls-validationSkip TLS certificate verification
basic-auth-passwordSTRING-PPassword for Basic Auth
basic-auth-usernameSTRING-UUsername for Basic Auth
positive-status-codesSTRING-sPositive status codes (will be overwritten with status-codes-blacklist if set)
blacklist-status-codesSTRING-bNegative status codes (will override status-codes if set)
force-continued-wildcardBOOLEAN--wildcardForce continued operation when wildcard found

example

Run gobuster-dir

gobuster-dir · command
# brute-force directories and files; body length is printed by default
gobuster dir -u https://example.com -w /wordlists/common.txt -x php,bak -t 50
sample output
/.htaccess            (Status: 403) [Size: 278]
/admin                (Status: 301) [Size: 315] [--> https://example.com/admin/]
/backup               (Status: 301) [Size: 316] [--> https://example.com/backup/]
/config.php           (Status: 200) [Size: 0]
/index.php            (Status: 200) [Size: 10842]
/login                (Status: 200) [Size: 4210]
/robots.txt           (Status: 200) [Size: 142]
/server-status        (Status: 403) [Size: 300]
/uploads              (Status: 301) [Size: 317] [--> https://example.com/uploads/]

guidance

Choosing gobuster-dir

Use gobuster-dir to brute-force directories and files on a host you already know is live. Prefer it for straightforward -u/-w content discovery. Reach for ffuf or feroxbuster when you need richer filtering, recursion, or parameter and vhost fuzzing.

ffuf

General FUZZ engine with richer response filtering plus parameter and vhost modes. Prefer when path brute force is only one of several fuzz jobs.

feroxbuster

Recursive content discovery with smart defaults. Prefer when you want automatic walks into directories it finds.

dirsearch

Python directory brute-forcer with built-in extension handling and recursion. Close peer for classic content discovery.

faq

gobuster-dir questions

Pass -b with the codes to drop, for example -b 404,500. -b defaults to 404, and gobuster refuses to run with both -s and -b set, so to use a positive -s list pass -b "" alongside it.

Set --no-tls-validation so a self-signed or expired certificate does not stop the scan. The Trickest node exposes that long form of the option.

Yes. Point -w at a wordlist and add -x with extensions like php,bak,zip so each word is also requested with those suffixes. Response length is printed for each hit, so a soft-404 shows up as many results of one size; drop them with --exclude-length.

Not by default; a 301 or 302 is reported as a hit with its Location. Add -r to follow redirects and record the final response. Use -e for expanded mode that prints full URLs.

gobuster dir is built for directory and file wordlists against -u. ffuf is a general FUZZ engine with richer filters and extra modes. Start here for simple path brute force; move to ffuf when the job grows.

No. gobuster dir has no recursion option; it only tests wordlist entries under the -u URL you give it. To go deeper, run it again with a discovered directory as the new -u, or use a tool with built-in recursion such as feroxbuster, dirsearch (-r) or ffuf (-recursion).

gobuster is a single Go binary whose dir mode brute-forces paths from your wordlist without recursion, and it also has dns, vhost, s3, gcs, tftp and fuzz modes. dirsearch is a Python web path brute-forcer focused on content discovery, with extension handling via -e and built-in recursion via -r and --max-recursion-depth.

related

More Discovery tools

  1. apkurlgrep

    Extract URLs and endpoints from Android APK files.

  2. cariddi

    Crawl a domain list and scan responses for endpoints, secrets, tokens, and juicy files.

  3. crawlergo

    Browser-driven crawler that harvests requests for downstream scanners.

  4. dirsearch

    Web path scanner.

  5. fallparams

    Crawl pages, harvest potential parameters, write a custom wordlist.

  6. feroxbuster

    Recursive content discovery with smart defaults and rich response filters.

Run gobuster-dir yourself

A target URL and a wordlist feed gobuster-dir, which brute-forces paths and writes the directories and files it discovers as a queryable output.

Open gobuster-dir in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.