GoBuster_Compact_Manual_user_guide_.pptx

teaches you about gobuster

1. GoBuster — Compact Manual CLI dir/file, DNS, vhost, S3 brute-forcing tool Concise manual for assignment

2. 1. Introduction What it is: GoBuster - high-performance CLI tool (Go) for brute-forcing dirs/files, DNS subdomains, vhosts, S3/GCS buckets. Why use it: Fast (concurrency), simple flags, ideal for recon workflows; replacement for older tools like DirBuster. Legal: Only run with explicit authorization — unauthorized use is illegal.

3. 2. Installation (Linux & Windows) Via package manager (Debian/Ubuntu/Kali): sudo apt update && sudo apt install gobuster From GitHub (recommended): go install github.com/OJ/gobuster/v3@latest OR git clone && go build Precompiled binaries: download Releases for Windows/macOS and unzip.

4. 3. Basic usage & common flags General form: gobuster <mode> [flags] (modes: dir, dns, vhost, s3) Useful flags: -u URL, -w wordlist, -t threads, -x extensions, -s status, -o output, -m method, --delay, -q quiet Help: gobuster --help or gobuster <mode> --help

5. 4. Demonstrations (examples) Example 1 — Directory enumeration (basic) gobuster dir -u https://target.example.com/ -w /usr/share/wordlists/dirb/common.txt -t 50 -o gobuster-dir.txt Explanation: dir mode, high concurrency (-t 50). Use smaller threads for fragile servers. Example 2 — Try common extensions (php,txt,bak) gobuster dir -u https://target.example.com/ -w wordlist.txt -x php,txt,bak -t 20 Explanation: appends extensions to find backups/configs.

6. 4. Demonstrations (examples) Example 3 — Subdomain enumeration (DNS mode) gobuster dns -d example.com -w /usr/share/wordlists/dns/subdomains-top1million-110000.txt -t 50 -o gobuster-dns.txt Explanation: DNS brute force; watch for wildcard DNS false positives. Example 4 — Virtual host (vhost) discovery gobuster vhost -u https://target.example.com -w vhosts.txt -t 30 Explanation: Vhost detection via Host header variations.

7. 4. Demonstrations (examples) Example 5 — POST method + delay (less noisy) gobuster dir -u https://target.example.com/ -w wordlist.txt -m POST --delay 500ms -t 5 Explanation: Use when GET blocked or to avoid WAF triggering; lower threads + delay.

8. 5. Applications in cybersecurity Web recon / content discovery for pentests and bug bounties (hidden panels, backups, dev pages). Subdomain discovery for external attack surface mapping. Automated scanning in CI for asset discovery (internal pentesting). Adversary tradecraft: attackers also use such tools (noted in threat reports).

9. 6. Limitations & caveats False positives / wildcard DNS: validate DNS findings due to wildcard records. Rate-limiting / WAF / IDS: aggressive scans may trigger protections; tune -t and --delay. Wordlist dependency: outcomes depend on wordlist quality (use SecLists/custom lists). No response analysis: combine with Burp, Nuclei for deeper validation; not ideal for large-scale DNS at scale.

10. 7. Quick troubleshooting tips Command not found: ensure gobuster installed and Go bin in PATH. Many 403/404: try -s to show different codes and -x for extensions. Reduce WAF hits: lower threads, add --delay, random UA, or proxy via Burp.

11. 8. References / further reading Official GitHub: https://github.com/OJ/gobuster (source & releases) Official docs: gobuster.org Kali Tools entry & tutorials: Kali docs, community writeups Wordlists: SecLists (github.com/danielmiessler/SecLists) Threat reports: Clearsky APT writeups (example of brute force usage)