Codebase list gobuster / 394045d
New upstream version 3.0.1 Sophie Brun 4 years ago
3 changed file(s) with 188 addition(s) and 156 deletion(s). Raw diff Collapse all Expand all
+186
-155
README.md less more
0 # Gobuster v3.0.0 (OJ Reeves @TheColonial)
0 # Gobuster v3.0.1 (OJ Reeves @TheColonial)
11
22 Gobuster is a tool used to brute-force:
33
5858 * `gobuster help` - outputs the top-level help.
5959 * `gobuster help <mode>` - outputs the help specific to that mode.
6060
61 ## Common Command Line Options (all modes)
61 ## `dns` Mode Help
6262
6363 ```text
64 -h, --help Help for gobuster
65 --noprogress Don't display progress
66 -o, --output string Output file to write results to (defaults to stdout)
67 -q, --quiet Don't print the banner and other noise
68 -t, --threads int Number of concurrent threads (default 10)
69 -v, --verbose Verbose output (errors)
70 -w, --wordlist string Path to the wordlist
71 ```
72
73 ## `dns` Mode Options
64 Usage:
65 gobuster dns [flags]
66
67 Flags:
68 -d, --domain string The target domain
69 -h, --help help for dns
70 -r, --resolver string Use custom DNS server (format server.com or server.com:port)
71 -c, --showcname Show CNAME records (cannot be used with '-i' option)
72 -i, --showips Show IP addresses
73 --timeout duration DNS resolver timeout (default 1s)
74 --wildcard Force continued operation when wildcard found
75
76 Global Flags:
77 -z, --noprogress Don't display progress
78 -o, --output string Output file to write results to (defaults to stdout)
79 -q, --quiet Don't print the banner and other noise
80 -t, --threads int Number of concurrent threads (default 10)
81 -v, --verbose Verbose output (errors)
82 -w, --wordlist string Path to the wordlist
83 ```
84
85 ## `dir` Mode Options
7486
7587 ```text
76 -d, --domain string The target domain
77 -h, --help Help for dns
78 -r, --resolver string Use custom DNS server (format server.com or server.com:port)
79 -c, --showcname Show CNAME records (cannot be used with '-i' option)
80 -i, --showips Show IP addresses
81 --timeout duration DNS resolver timeout (default 1s)
82 --wildcard Force continued operation when wildcard found
83 ```
84
85 ## `dir` Mode Options
88 Usage:
89 gobuster dir [flags]
90
91 Flags:
92 -f, --addslash Apped / to each request
93 -c, --cookies string Cookies to use for the requests
94 -e, --expanded Expanded mode, print full URLs
95 -x, --extensions string File extension(s) to search for
96 -r, --followredirect Follow redirects
97 -H, --headers stringArray Specify HTTP headers, -H 'Header1: val1' -H 'Header2: val2'
98 -h, --help help for dir
99 -l, --includelength Include the length of the body in the output
100 -k, --insecuressl Skip SSL certificate verification
101 -n, --nostatus Don't print status codes
102 -P, --password string Password for Basic Auth
103 -p, --proxy string Proxy to use for requests [http(s)://host:port]
104 -s, --statuscodes string Positive status codes (will be overwritten with statuscodesblacklist if set) (default "200,204,301,302,307,401,403")
105 -b, --statuscodesblacklist string Negative status codes (will override statuscodes if set)
106 --timeout duration HTTP Timeout (default 10s)
107 -u, --url string The target URL
108 -a, --useragent string Set the User-Agent string (default "gobuster/3.0.1")
109 -U, --username string Username for Basic Auth
110 --wildcard Force continued operation when wildcard found
111
112 Global Flags:
113 -z, --noprogress Don't display progress
114 -o, --output string Output file to write results to (defaults to stdout)
115 -q, --quiet Don't print the banner and other noise
116 -t, --threads int Number of concurrent threads (default 10)
117 -v, --verbose Verbose output (errors)
118 -w, --wordlist string Path to the wordlist
119 ```
120
121 ## `vhost` Mode Options
86122
87123 ```text
88 -f, --addslash Apped / to each request
89 -c, --cookies string Cookies to use for the requests
90 -e, --expanded Expanded mode, print full URLs
91 -x, --extensions string File extension(s) to search for
92 -r, --followredirect Follow redirects
93 -h, --help Help for dir
94 -l, --includelength Include the length of the body in the output
95 -k, --insecuressl Skip SSL certificate verification
96 -n, --nostatus Don't print status codes
97 -P, --password string Password for Basic Auth
98 -p, --proxy string Proxy to use for requests [http(s)://host:port]
99 -s, --statuscodes string Positive status codes (default "200,204,301,302,307,401,403")
100 --timeout duration HTTP Timeout (default 10s)
101 -u, --url string The target URL
102 -a, --useragent string Set the User-Agent string (default "gobuster/3.0.0")
103 -U, --username string Username for Basic Auth
104 --wildcard Force continued operation when wildcard found
105 ```
106
107 ## `vhost` Mode Options
108
109 ```text
110 -c, --cookies string Cookies to use for the requests
111 -r, --followredirect Follow redirects (default true)
112 -h, --help help for vhost
113 -k, --insecuressl Skip SSL certificate verification
114 -P, --password string Password for Basic Auth
115 -p, --proxy string Proxy to use for requests [http(s)://host:port]
116 --timeout duration HTTP Timeout (default 10s)
117 -u, --url string The target URL
118 -a, --useragent string Set the User-Agent string (default "gobuster/3.0.0")
119 -U, --username string Username for Basic Auth
124 Usage:
125 gobuster vhost [flags]
126
127 Flags:
128 -c, --cookies string Cookies to use for the requests
129 -r, --followredirect Follow redirects
130 -H, --headers stringArray Specify HTTP headers, -H 'Header1: val1' -H 'Header2: val2'
131 -h, --help help for vhost
132 -k, --insecuressl Skip SSL certificate verification
133 -P, --password string Password for Basic Auth
134 -p, --proxy string Proxy to use for requests [http(s)://host:port]
135 --timeout duration HTTP Timeout (default 10s)
136 -u, --url string The target URL
137 -a, --useragent string Set the User-Agent string (default "gobuster/3.0.1")
138 -U, --username string Username for Basic Auth
139
140 Global Flags:
141 -z, --noprogress Don't display progress
142 -o, --output string Output file to write results to (defaults to stdout)
143 -q, --quiet Don't print the banner and other noise
144 -t, --threads int Number of concurrent threads (default 10)
145 -v, --verbose Verbose output (errors)
146 -w, --wordlist string Path to the wordlist
120147 ```
121148
122149 ## Easy Installation
163190 * `make clean` - clears out the `build` subfolder.
164191 * `make test` - runs the tests.
165192
166 ### Running as a Script
167
168 ```bash
169 go run main.go <parameters>
170 ```
171
172193 ## Wordlists via STDIN
173194
174195 Wordlists can be piped into `gobuster` via stdin by providing a `-` to the `-w` option:
194215 ```bash
195216 gobuster dir -u https://buffered.io -w ~/wordlists/shortlist.txt
196217
197 =====================================================
198 Gobuster v3.0.0 OJ Reeves (@TheColonial)
199 =====================================================
218 ===============================================================
219 Gobuster v3.0.1
220 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
221 ===============================================================
200222 [+] Mode : dir
201223 [+] Url/Domain : https://buffered.io/
202224 [+] Threads : 10
204226 [+] Status codes : 200,204,301,302,307,401,403
205227 [+] User Agent : gobuster/3.0.1
206228 [+] Timeout : 10s
207 =====================================================
208 2018/08/27 11:49:43 Starting gobuster
209 =====================================================
229 ===============================================================
230 2019/06/21 11:49:43 Starting gobuster
231 ===============================================================
210232 /categories (Status: 301)
211233 /contact (Status: 301)
212234 /posts (Status: 301)
213235 /index (Status: 200)
214 =====================================================
215 2018/08/27 11:49:44 Finished
216 =====================================================
236 ===============================================================
237 2019/06/21 11:49:44 Finished
238 ===============================================================
217239 ```
218240
219241 Default options with status codes disabled looks like this:
221243 ```bash
222244 gobuster dir -u https://buffered.io -w ~/wordlists/shortlist.txt -n
223245
224 =====================================================
225 Gobuster v3.0.0 OJ Reeves (@TheColonial)
226 =====================================================
246 ===============================================================
247 Gobuster v3.0.1
248 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
249 ===============================================================
227250 [+] Mode : dir
228251 [+] Url/Domain : https://buffered.io/
229252 [+] Threads : 10
232255 [+] User Agent : gobuster/3.0.1
233256 [+] No status : true
234257 [+] Timeout : 10s
235 =====================================================
236 2018/08/27 11:50:18 Starting gobuster
237 =====================================================
258 ===============================================================
259 2019/06/21 11:50:18 Starting gobuster
260 ===============================================================
238261 /categories
239262 /contact
240263 /index
241264 /posts
242 =====================================================
243 2018/08/27 11:50:18 Finished
244 =====================================================
265 ===============================================================
266 2019/06/21 11:50:18 Finished
267 ===============================================================
245268 ```
246269
247270 Verbose output looks like this:
249272 ```bash
250273 gobuster dir -u https://buffered.io -w ~/wordlists/shortlist.txt -v
251274
252 =====================================================
253 Gobuster v3.0.0 OJ Reeves (@TheColonial)
254 =====================================================
275 ===============================================================
276 Gobuster v3.0.1
277 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
278 ===============================================================
255279 [+] Mode : dir
256280 [+] Url/Domain : https://buffered.io/
257281 [+] Threads : 10
260284 [+] User Agent : gobuster/3.0.1
261285 [+] Verbose : true
262286 [+] Timeout : 10s
263 =====================================================
264 2018/08/27 11:50:51 Starting gobuster
265 =====================================================
287 ===============================================================
288 2019/06/21 11:50:51 Starting gobuster
289 ===============================================================
266290 Missed: /alsodoesnotexist (Status: 404)
267291 Found: /index (Status: 200)
268292 Missed: /doesnotexist (Status: 404)
269293 Found: /categories (Status: 301)
270294 Found: /posts (Status: 301)
271295 Found: /contact (Status: 301)
272 =====================================================
273 2018/08/27 11:50:51 Finished
274 =====================================================
296 ===============================================================
297 2019/06/21 11:50:51 Finished
298 ===============================================================
275299 ```
276300
277301 Example showing content length:
279303 ```bash
280304 gobuster dir -u https://buffered.io -w ~/wordlists/shortlist.txt -l
281305
282 =====================================================
283 Gobuster v3.0.0 OJ Reeves (@TheColonial)
284 =====================================================
306 ===============================================================
307 Gobuster v3.0.1
308 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
309 ===============================================================
285310 [+] Mode : dir
286311 [+] Url/Domain : https://buffered.io/
287312 [+] Threads : 10
290315 [+] User Agent : gobuster/3.0.1
291316 [+] Show length : true
292317 [+] Timeout : 10s
293 =====================================================
294 2018/08/27 11:51:16 Starting gobuster
295 =====================================================
318 ===============================================================
319 2019/06/21 11:51:16 Starting gobuster
320 ===============================================================
296321 /categories (Status: 301) [Size: 178]
297322 /posts (Status: 301) [Size: 178]
298323 /contact (Status: 301) [Size: 178]
299324 /index (Status: 200) [Size: 51759]
300 =====================================================
301 2018/08/27 11:51:17 Finished
302 =====================================================
325 ===============================================================
326 2019/06/21 11:51:17 Finished
327 ===============================================================
303328 ```
304329
305330 Quiet output, with status disabled and expanded mode looks like this ("grep mode"):
325350 ```bash
326351 gobuster dns -d google.com -w ~/wordlists/subdomains.txt
327352
328 =====================================================
329 Gobuster v3.0.0 OJ Reeves (@TheColonial)
330 =====================================================
353 ===============================================================
354 Gobuster v3.0.1
355 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
356 ===============================================================
331357 [+] Mode : dns
332358 [+] Url/Domain : google.com
333359 [+] Threads : 10
334360 [+] Wordlist : /home/oj/wordlists/subdomains.txt
335 =====================================================
336 2018/08/27 11:54:20 Starting gobuster
337 =====================================================
361 ===============================================================
362 2019/06/21 11:54:20 Starting gobuster
363 ===============================================================
338364 Found: chrome.google.com
339365 Found: ns1.google.com
340366 Found: admin.google.com
353379 Found: directory.google.com
354380 Found: local.google.com
355381 Found: blog.google.com
356 =====================================================
357 2018/08/27 11:54:20 Finished
358 =====================================================
382 ===============================================================
383 2019/06/21 11:54:20 Finished
384 ===============================================================
359385 ```
360386
361387 Show IP sample run goes like this:
363389 ```bash
364390 gobuster dns -d google.com -w ~/wordlists/subdomains.txt -i
365391
366 =====================================================
367 Gobuster v3.0.0 OJ Reeves (@TheColonial)
368 =====================================================
392 ===============================================================
393 Gobuster v3.0.1
394 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
395 ===============================================================
369396 [+] Mode : dns
370397 [+] Url/Domain : google.com
371398 [+] Threads : 10
372399 [+] Wordlist : /home/oj/wordlists/subdomains.txt
373 =====================================================
374 2018/08/27 11:54:54 Starting gobuster
375 =====================================================
400 ===============================================================
401 2019/06/21 11:54:54 Starting gobuster
402 ===============================================================
376403 Found: www.google.com [172.217.25.36, 2404:6800:4006:802::2004]
377404 Found: admin.google.com [172.217.25.46, 2404:6800:4006:806::200e]
378405 Found: store.google.com [172.217.167.78, 2404:6800:4006:802::200e]
391418 Found: translate.google.com [172.217.25.46, 2404:6800:4006:802::200e]
392419 Found: music.google.com [172.217.25.46, 2404:6800:4006:802::200e]
393420 Found: mail.google.com [172.217.25.37, 2404:6800:4006:802::2005]
394 =====================================================
395 2018/08/27 11:54:55 Finished
396 =====================================================
421 ===============================================================
422 2019/06/21 11:54:55 Finished
423 ===============================================================
397424 ```
398425
399426 Base domain validation warning when the base domain fails to resolve. This is a warning rather than a failure in case the user fat-fingers while typing the domain.
401428 ```bash
402429 gobuster dns -d yp.to -w ~/wordlists/subdomains.txt -i
403430
404 =====================================================
405 Gobuster v3.0.0 OJ Reeves (@TheColonial)
406 =====================================================
431 ===============================================================
432 Gobuster v3.0.1
433 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
434 ===============================================================
407435 [+] Mode : dns
408436 [+] Url/Domain : yp.to
409437 [+] Threads : 10
410438 [+] Wordlist : /home/oj/wordlists/subdomains.txt
411 =====================================================
412 2018/08/27 11:56:43 Starting gobuster
413 =====================================================
414 2018/08/27 11:56:53 [-] Unable to validate base domain: yp.to
439 ===============================================================
440 2019/06/21 11:56:43 Starting gobuster
441 ===============================================================
442 2019/06/21 11:56:53 [-] Unable to validate base domain: yp.to
415443 Found: cr.yp.to [131.193.32.108, 131.193.32.109]
416 =====================================================
417 2018/08/27 11:56:53 Finished
418 =====================================================
444 ===============================================================
445 2019/06/21 11:56:53 Finished
446 ===============================================================
419447 ```
420448
421449 Wildcard DNS is also detected properly:
423451 ```bash
424452 gobuster dns -d 0.0.1.xip.io -w ~/wordlists/subdomains.txt
425453
426 =====================================================
427 Gobuster v3.0.0 OJ Reeves (@TheColonial)
428 =====================================================
454 ===============================================================
455 Gobuster v3.0.1
456 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
457 ===============================================================
429458 [+] Mode : dns
430459 [+] Url/Domain : 0.0.1.xip.io
431460 [+] Threads : 10
432461 [+] Wordlist : /home/oj/wordlists/subdomains.txt
433 =====================================================
434 2018/08/27 12:13:48 Starting gobuster
435 =====================================================
436 2018/08/27 12:13:48 [-] Wildcard DNS found. IP address(es): 1.0.0.0
437 2018/08/27 12:13:48 [!] To force processing of Wildcard DNS, specify the '--wildcard' switch.
438 =====================================================
439 2018/08/27 12:13:48 Finished
440 =====================================================
462 ===============================================================
463 2019/06/21 12:13:48 Starting gobuster
464 ===============================================================
465 2019/06/21 12:13:48 [-] Wildcard DNS found. IP address(es): 1.0.0.0
466 2019/06/21 12:13:48 [!] To force processing of Wildcard DNS, specify the '--wildcard' switch.
467 ===============================================================
468 2019/06/21 12:13:48 Finished
469 ===============================================================
441470 ```
442471
443472 If the user wants to force processing of a domain that has wildcard entries, use `--wildcard`:
445474 ```bash
446475 gobuster dns -d 0.0.1.xip.io -w ~/wordlists/subdomains.txt --wildcard
447476
448 =====================================================
449 Gobuster v3.0.0 OJ Reeves (@TheColonial)
450 =====================================================
477 ===============================================================
478 Gobuster v3.0.1
479 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
480 ===============================================================
451481 [+] Mode : dns
452482 [+] Url/Domain : 0.0.1.xip.io
453483 [+] Threads : 10
454484 [+] Wordlist : /home/oj/wordlists/subdomains.txt
455 =====================================================
456 2018/08/27 12:13:51 Starting gobuster
457 =====================================================
458 2018/08/27 12:13:51 [-] Wildcard DNS found. IP address(es): 1.0.0.0
485 ===============================================================
486 2019/06/21 12:13:51 Starting gobuster
487 ===============================================================
488 2019/06/21 12:13:51 [-] Wildcard DNS found. IP address(es): 1.0.0.0
459489 Found: 127.0.0.1.xip.io
460490 Found: test.127.0.0.1.xip.io
461 =====================================================
462 2018/08/27 12:13:53 Finished
463 =====================================================
491 ===============================================================
492 2019/06/21 12:13:53 Finished
493 ===============================================================
464494 ```
465495
466496 ### `vhost` Mode
476506 ```bash
477507 gobuster vhost -u https://mysite.com -w common-vhosts.txt
478508
479 =====================================================
480 Gobuster v3.0.0 OJ Reeves (@TheColonial)
481 =====================================================
509 ===============================================================
510 Gobuster v3.0.1
511 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
512 ===============================================================
482513 [+] Url: https://mysite.com
483514 [+] Threads: 10
484515 [+] Wordlist: common-vhosts.txt
485 [+] User Agent: gobuster 3.0.0
516 [+] User Agent: gobuster/3.0.1
486517 [+] Timeout: 10s
487 =====================================================
488 2018/10/09 08:36:00 Starting gobuster
489 =====================================================
518 ===============================================================
519 2019/06/21 08:36:00 Starting gobuster
520 ===============================================================
490521 Found: www.mysite.com
491522 Found: piwik.mysite.com
492523 Found: mail.mysite.com
493 =====================================================
494 2018/10/09 08:36:05 Finished
495 =====================================================
524 ===============================================================
525 2019/06/21 08:36:05 Finished
526 ===============================================================
496527 ```
497528
498529 ## License
+1
-0
gobusterdir/gobusterdir.go less more
5454 Proxy: opts.Proxy,
5555 FollowRedirect: opts.FollowRedirect,
5656 InsecureSSL: opts.InsecureSSL,
57 IncludeLength: opts.IncludeLength,
5758 Timeout: opts.Timeout,
5859 Username: opts.Username,
5960 Password: opts.Password,
+1
-1
libgobuster/version.go less more
11
22 const (
33 // VERSION contains the current gobuster version
4 VERSION = "3.0.0 (beta)"
4 VERSION = "3.0.1"
55 )