Gobuster — Directory & DNS Fuzzer GuideGobuster guide: brute-force hidden directories, files, subdomains and vhosts on your own lab apps like DVWA. Educational lab-only tutorial. 2026 update.FAQ

What is Gobuster?

Gobuster is a fast Go tool that finds hidden web content by trying wordlist entries as URLs: /admin, /backup.zip, /api/v2. Attackers use it to find forgotten pages; defenders use it to find what they forgot to protect.

Is Gobuster illegal?

The tool is legal for audits. Fuzzing sites you do not own can count as unauthorized access and can overload small servers, so stick to your own labs (DVWA, Juice Shop) or permitted targets.

What is the difference between dir, dns and vhost modes?

dir mode brute-forces URL paths on a site. dns mode brute-forces subdomains via DNS lookups. vhost mode brute-forces virtual hosts on one IP by changing the Host header — three views of the same guessing game.

Which wordlist should I start with?

For labs, the small directory-list-2.3-medium list is the classic start; SecLists raft files go deeper. Bigger lists find more but take longer and hit harder — match the list to the lab, not the internet.

What do status codes 200, 301, 403 mean here?

200 means the path exists and opened. 301/302 is a redirect — follow it, something lives there. 403 means forbidden: the path exists but needs auth, which is itself a finding worth noting.

How do I fuzz subdomains with Gobuster?

Use dns mode with your lab domain: gobuster dns -d example.lab -w subdomains.txt. It resolves each guess and reports the ones with DNS records — the same recon attackers run before anything else.

Why do I get thousands of false positives?

Wildcard responses: the server answers 200 to everything. Calibrate with a random string first, note its length, then use --exclude-length to hide that size from results.

How do I protect my site from Gobuster?

Require auth on every sensitive path, disable directory listing, rate-limit 404-heavy clients, and monitor logs for enumeration patterns. Then run Gobuster against your own staging: what you find first, attackers never will.

All tools · Sitemap · Games