Gobuster — OSCP Notes

What is Gobuster?

Fast, concurrent brute-force enumeration tool written in Go. Primary use is discovering hidden directories/files on web servers, subdomains via DNS, and virtual hosts. Unlike crawlers, it brute-forces paths from a wordlist — no JavaScript rendering needed.

OSCP relevance: Almost always used in the initial web enumeration phase to find hidden admin panels, backup files, API endpoints, or upload directories.

Install (Kali)

sudo apt update && sudo apt install -y gobuster

Verify: gobuster version

Full install index → Installation - Kali Setup

Modes

Mode	Purpose
`dir`	Brute-force directories and files on a web server
`dns`	Brute-force DNS subdomains
`vhost`	Brute-force virtual hosts (via Host header fuzzing)
`fuzz`	General fuzzing — inject `FUZZ` keyword anywhere
`s3`	Enumerate open Amazon S3 buckets

📌 1) dir — Directory & File Brute-Force

Wordlists (Kali):

Speed	Path
Quick (start here)	`/usr/share/wordlists/dirb/common.txt`
Medium	`/usr/share/wordlists/dirb/big.txt`
Thorough	`/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt`
Huge	`/usr/share/wordlists/dirbuster/directory-list-2.3-big.txt`
SecLists alt	`/usr/share/seclists/Discovery/Web-Content/common.txt`
API paths	`/usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt`
Backups	`/usr/share/seclists/Discovery/Web-Content/Common-DB-Backups.txt`

Install: sudo apt install seclists wordlists · Find more: ls /usr/share/seclists/Discovery/Web-Content/

Basic usage

gobuster dir -u http://TARGET -w /usr/share/wordlists/dirb/common.txt

With file extensions

gobuster dir -u http://TARGET -w /usr/share/wordlists/dirb/common.txt -x php,txt,html,bak

Follow redirects + show status codes

gobuster dir -u http://TARGET -w /usr/share/wordlists/dirb/common.txt -r -s "200,204,301,302,307,403"

gobuster dir -u http://TARGET -w /usr/share/wordlists/dirb/common.txt \
  -c "PHPSESSID=abc123; security=low"

Authenticated scan (Basic Auth)

gobuster dir -u http://TARGET -w /usr/share/wordlists/dirb/common.txt \
  -U admin -P password

Custom User-Agent + threads

gobuster dir -u http://TARGET -w /usr/share/wordlists/dirb/common.txt \
  -a "Mozilla/5.0" -t 50

Output results to file

gobuster dir -u http://TARGET -w /usr/share/wordlists/dirb/common.txt -o gobuster_out.txt

Ignore SSL cert errors (HTTPS)

gobuster dir -u https://TARGET -w /usr/share/wordlists/dirb/common.txt -k

📌 2) dns — Subdomain Brute-Force

Wordlists (Kali):

Speed	Path
Quick (5k)	`/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt`
Medium (20k)	`/usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt`
Large (110k)	`/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt`
Jhaddix	`/usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt`
dnsrecon default	`/usr/share/dnsrecon/namelist.txt`
Legacy	`/usr/share/wordlists/dnsmap.txt`

gobuster dns -d TARGET.com \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Show IP addresses of found subdomains

gobuster dns -d TARGET.com \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -i

📌 3) vhost — Virtual Host Enumeration

Useful when a single IP hosts multiple domains (common in CTFs/OSCP).

Wordlists (Kali): same as DNS — vhost = Host header fuzzing with subdomain names:

Use	Path
Default	`/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt`
Larger	`/usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt`
HTB-style names	`/usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt`

gobuster vhost -u http://TARGET \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Append domain to wordlist entries

gobuster vhost -u http://TARGET \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  --append-domain

📌 4) fuzz — Generic Fuzzing

Wordlist: /usr/share/wordlists/dirb/common.txt or /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt

gobuster fuzz -u http://TARGET/FUZZ -w /usr/share/wordlists/dirb/common.txt

Common Flags Reference

Flag	Description
`-u <url>`	Target URL
`-w <wordlist>`	Path to wordlist
`-x <ext,ext>`	File extensions to append (e.g., `php,txt,html,bak`)
`-t <N>`	Number of concurrent threads (default: 10)
`-o <file>`	Save output to file
`-s <codes>`	Positive status codes (e.g., `200,301,302`)
`-b <codes>`	Negative status codes to exclude (e.g., `404,403`)
`-r`	Follow HTTP redirects
`--exclude-length <N>`	Exclude responses with this body length (comma-separated)
`-k`	Skip TLS certificate verification
`-c <cookie>`	Add cookie string
`-H <header>`	Add custom header (repeatable)
`-U <username>`	HTTP Basic Auth username
`-P <password>`	HTTP Basic Auth password
`-a <user-agent>`	Custom User-Agent string
`-p <proxy>`	Proxy URL (e.g., `http://127.0.0.1:8080`)
`-e`	Print full URLs in output
`-q`	Quiet mode (no banner)
`-v`	Verbose — include negative results
`--timeout <dur>`	HTTP timeout (default: 10s)
`--delay <dur>`	Delay between requests (e.g., `100ms`)
`--no-tls-validation`	Same as `-k` (alias)
`-i`	Show IP addresses (dns mode)
`-d <domain>`	Target domain (dns mode)
`--append-domain`	Append base domain to wordlist entries (vhost/dns mode)

📌 5) Wildcard / False-Positive Responses

Gobuster may warn that it detected a wildcard response — meaning invalid paths look the same as valid ones, so results are unreliable.

What’s happening (302 redirect trap)

You request a random path:

/manage/1c92a3fb-9630-4fa6-a3cf-85aabb14400a

The server responds:

302 → /manage/account/login?redirect=...

If every path (real or fake) returns the same 302 to login, Gobuster cannot tell valid directories from invalid ones. You’ll get noise or nothing useful until you’re authenticated.

Random path  → 302 → /manage/account/login
Valid path   → 302 → /manage/account/login   ← same response = wildcard trap

Step 1 — Verify manually first

Before tweaking Gobuster flags, confirm the behavior with curl:

# Random path — should 404 or differ if enumeration is useful
curl -k -I https://uni.htb:8443/manage/asdf123
 
# Known/suspected valid paths
curl -k -I https://uni.htb:8443/manage/account
curl -k -I https://uni.htb:8443/manage/login

Decision:

Result	What it means
Random + valid paths all return same 302 + same length	Dir brute-force here is useless until you authenticate
Valid paths return different status/length/redirect than random	Enumeration can work — use options below

OSCP rule: If everything redirects to login, get creds first (SQLi, default creds, LFI, file upload), then re-run Gobuster with a session cookie.

Option 1 — Exclude status codes (`-b`)

If everything redirects to login, hide 302 (and usually 404):

gobuster dir \
  -u https://uni.htb:8443/manage/ \
  -k \
  -w /usr/share/wordlists/dirb/big.txt \
  -x php,txt \
  -b 302,404

Use when: most junk hits are 302 or 404, and real paths return 200, 301, or 403.

Option 2 — Exclude by response length (`--exclude-length`)

Gobuster may report junk entries as Length: 0. Exclude that size:

gobuster dir \
  -u https://uni.htb:8443/manage/ \
  -k \
  -w /usr/share/wordlists/dirb/big.txt \
  -x php,txt \
  --exclude-length 0

Use when: false positives share the same body length but status codes vary. You can exclude multiple lengths: --exclude-length 0,162,534.

Option 3 — Follow redirects (`-r`)

Sometimes after following redirects, valid paths land somewhere different from invalid ones:

gobuster dir \
  -u https://uni.htb:8443/manage/ \
  -k \
  -w /usr/share/wordlists/dirb/big.txt \
  -x php,txt \
  -r \
  --exclude-length 0

Use when: invalid paths redirect to login (length 0), but valid paths redirect to a page with different content length.

Option 4 — Authenticated scan (best fix if you have creds)

Once you have a session cookie, re-scan the protected area:

gobuster dir \
  -u https://uni.htb:8443/manage/ \
  -k \
  -w /usr/share/wordlists/dirb/big.txt \
  -x php,txt \
  -c "session=YOUR_COOKIE_HERE" \
  -b 404

Quick decision guide

Gobuster says "wildcard detected" or floods with 302s?
│
├─ curl random path vs known path
│   ├─ Same 302 + same length → STOP dir brute here; authenticate first
│   └─ Different response → try -b 302,404 or --exclude-length 0
│
├─ Still noisy?
│   └─ Combine: -b 302,404 --exclude-length 0 -r
│
└─ Have creds/cookie?
    └─ Re-run with -c "session=..." against the same URL

📌 Quick OSCP Cheat Sheet (Copy/Paste)

gobuster dir -u http://192.168.214.249:8000/cms/  -w /usr/share/wordlists/dirb/common.txt -q -n -e -b 302

# Standard dir scan — most common starting point
gobuster dir -u http://TARGET -w /usr/share/wordlists/dirb/common.txt -x php,txt,html -t 40 -o gobuster_dir.txt
 
# Bigger wordlist (slower but thorough)
gobuster dir -u http://TARGET -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html -t 30
 
# HTTPS target, ignore cert errors
gobuster dir -u https://TARGET -w /usr/share/wordlists/dirb/common.txt -k -x php,txt
 
# DNS subdomain brute-force
gobuster dns -d TARGET.com \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -i
 
# Virtual host discovery
gobuster vhost -u http://TARGET \
  -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain
 
# Wildcard / 302 redirect trap (auth-required app)
curl -k -I https://TARGET/manage/asdf123
gobuster dir -u https://TARGET/manage/ -k -w /usr/share/wordlists/dirb/big.txt -x php,txt -b 302,404
gobuster dir -u https://TARGET/manage/ -k -w /usr/share/wordlists/dirb/big.txt -x php,txt --exclude-length 0
gobuster dir -u https://TARGET/manage/ -k -w /usr/share/wordlists/dirb/big.txt -x php,txt -r --exclude-length 0

📌 Kali Wordlists — Master Reference

Attack	Wordlist	Path
Dir — quick	dirb common	`/usr/share/wordlists/dirb/common.txt`
Dir — medium	dirb big	`/usr/share/wordlists/dirb/big.txt`
Dir — thorough	dirbuster medium	`/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt`
Dir — huge	dirbuster big	`/usr/share/wordlists/dirbuster/directory-list-2.3-big.txt`
Dir — SecLists	common / raft	`/usr/share/seclists/Discovery/Web-Content/common.txt`
Dir — raft	medium words	`/usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt`
API endpoints	api list	`/usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt`
Backup files	DB backups	`/usr/share/seclists/Discovery/Web-Content/Common-DB-Backups.txt`
Quick hits	high-value paths	`/usr/share/seclists/Discovery/Web-Content/QuickHits.txt`
DNS / subdomain	top 5k	`/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt`
DNS — larger	top 20k / 110k	`/usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt`
Vhost	same as DNS	`/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt`
Passwords	rockyou	`/usr/share/wordlists/rockyou.txt`
Site-specific	CeWL	Spider target URL → `cewl -w cewl.txt http://TARGET/`

# Verify wordlists exist
ls /usr/share/wordlists/dirb/
ls /usr/share/seclists/Discovery/Web-Content/ | head
ls /usr/share/seclists/Discovery/DNS/
sudo apt install seclists wordlists   # if missing

Tip: SecLists path on Kali is /usr/share/seclists/ (lowercase). Browse with ls before exam.

📌 WebSockets — discovery (HTTP only)

Gobuster fuzzes HTTP paths — it cannot send WebSocket frames. Use dir / fuzz to find endpoints that likely upgrade to ws:// / wss://, then switch to Burp Suite for message testing.

Paths to hunt

gobuster dir -u http://TARGET -w /usr/share/wordlists/dirb/common.txt \
  -x php,txt,html,js -s "200,301,302,403" -t 40
# watch for: /ws, /websocket, /socket.io, /cable, /api, /graphql → **[[GraphQL]]**, /live, /stream

fuzz mode — Host header + path

gobuster fuzz -u http://TARGET/FUZZ -w /usr/share/wordlists/dirb/common.txt \
  -b 404 -t 40

vhost + WebSocket apps

Real-time apps may live on a vhost only reachable via Host: header — same as normal web:

gobuster vhost -u http://TARGET -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

Found a WS path? Capture upgrade in Burp → edit JSON messages for SQLi → SQLMap HTTP harness if automating dumps.

Practical Tips for OSCP

Wildcard / 302 trap: If every path redirects to login, verify with curl -I before wasting time on Gobuster — see the Wildcard / False-Positive Responses section above.
Always start with -x php,txt,html — missed extensions = missed findings.
Run a second pass with a larger wordlist (directory-list-2.3-medium.txt) after the quick scan.
If you get a lot of 403s, try adding -b 403 to hide them, or specifically target those paths manually.
For HTTPS targets always add -k to avoid SSL errors stopping the scan.
Chain gobuster with Nmap — first confirm ports and services, then enumerate HTTP(S) with gobuster.
Use -p http://127.0.0.1:8080 to route through Curl/Burp for request inspection.
Combine with Nikto for a more complete web assessment picture.

Pearson's OSCP Notebook

Explorer

Gobuster

Gobuster — OSCP Notes

What is Gobuster?

Install (Kali)

Modes

📌 1) dir — Directory & File Brute-Force

Basic usage

With file extensions

Follow redirects + show status codes

Authenticated scan (Basic Auth)

Custom User-Agent + threads

Output results to file

Ignore SSL cert errors (HTTPS)

📌 2) dns — Subdomain Brute-Force

Show IP addresses of found subdomains

📌 3) vhost — Virtual Host Enumeration

Append domain to wordlist entries

📌 4) fuzz — Generic Fuzzing

Common Flags Reference

📌 5) Wildcard / False-Positive Responses

What’s happening (302 redirect trap)

Step 1 — Verify manually first

Option 1 — Exclude status codes (`-b`)

Option 2 — Exclude by response length (`--exclude-length`)

Option 3 — Follow redirects (`-r`)

Option 4 — Authenticated scan (best fix if you have creds)

Quick decision guide

📌 Quick OSCP Cheat Sheet (Copy/Paste)

📌 Kali Wordlists — Master Reference

📌 WebSockets — discovery (HTTP only)

Paths to hunt

fuzz mode — Host header + path

vhost + WebSocket apps

Practical Tips for OSCP

Graph View

Table of Contents

Backlinks

Pearson's OSCP Notebook

Explorer

Gobuster

Gobuster — OSCP Notes

What is Gobuster?

Install (Kali)

Modes

📌 1) dir — Directory & File Brute-Force

Basic usage

With file extensions

Follow redirects + show status codes

Authenticated scan (cookie)

Authenticated scan (Basic Auth)

Custom User-Agent + threads

Output results to file

Ignore SSL cert errors (HTTPS)

📌 2) dns — Subdomain Brute-Force

Show IP addresses of found subdomains

📌 3) vhost — Virtual Host Enumeration

Append domain to wordlist entries

📌 4) fuzz — Generic Fuzzing

Common Flags Reference

📌 5) Wildcard / False-Positive Responses

What’s happening (302 redirect trap)

Step 1 — Verify manually first

Option 1 — Exclude status codes (-b)

Option 2 — Exclude by response length (--exclude-length)

Option 3 — Follow redirects (-r)

Option 4 — Authenticated scan (best fix if you have creds)

Quick decision guide

📌 Quick OSCP Cheat Sheet (Copy/Paste)

📌 Kali Wordlists — Master Reference

📌 WebSockets — discovery (HTTP only)

Paths to hunt

fuzz mode — Host header + path

vhost + WebSocket apps

Practical Tips for OSCP

Related Tools

Related Notes

Graph View

Table of Contents

Backlinks

Option 1 — Exclude status codes (`-b`)

Option 2 — Exclude by response length (`--exclude-length`)

Option 3 — Follow redirects (`-r`)