gobuster_examples_cheatsheet_of_ubuntu.pptx

terminal commands of gobuster

1. GoBuster — Examples & Cheat Sheet 12 ready-to-run examples + brief tips Prepared for your assignment

2. Intro (1 line) GoBuster: fast CLI tool for dir/file, DNS, vhost, S3 brute-forcing.

3. Installation (Quick) Debian/Ubuntu/Kali: sudo apt update && sudo apt install gobuster From source (recommended): go install github.com/OJ/gobuster/v3@latest Windows/macOS: download precompiled binaries from GitHub Releases

4. Basic Usage General: gobuster <mode> [flags] (modes: dir, dns, vhost, s3) Common flags: -u URL, -w wordlist, -t threads, -x extensions, -o output, -s status Help: gobuster --help or gobuster dir --help

5. Examples (commands + tips) Directory - basic: gobuster dir -u https://target.example.com/ -w /usr/share/wordlists/dirb/common.txt -t 50 -o gobuster-dir.txt Tip: lower -t for fragile servers. Directory - extensions: gobuster dir -u https://target.example.com/ -w wordlists/raft-small-directories.txt -x php,html,txt,bak -t 30 Find backups/configs. Directory - status filter: gobuster dir -u https://target.example.com/admin -w wordlists/common.txt -t 20 -s "200,301,302" -o admin_hits.txt Show only useful codes.

6. Examples (commands + tips) Directory - gentle scan: gobuster dir -u https://target.example.com/ -w wordlists/big.txt -t 10 --delay 500ms Avoid WAF/rate limits. Vhost discovery: gobuster vhost -u https://10.0.0.5 -w vhosts.txt -t 40 -o vhost-results.txt Find virtual-hosted apps via Host header. DNS / subdomain: gobuster dns -d example.com -w /usr/share/wordlists/dns/subdomains-top1million-100000.txt -t 100 -o dns.txt Beware wildcard DNS false positives.

7. Examples (commands + tips) S3 / bucket discovery: gobuster s3 -b target-bucket -w wordlists/s3-bucket-list.txt -t 40 Enumerate S3/GCS prefixes or buckets (with permission). POST method fuzzing: gobuster dir -u https://target.example.com/ -w wordlists/custom.txt -m POST -H "Content-Type: application/x-www-form-urlencoded" --data "id=FUZZ" -t 10 Use POST when endpoints accept only POST. Proxy via Burp: gobuster dir -u https://target.example.com/ -w wordlists/raft-small.txt -t 20 --proxy http://127.0.0.1:8080 Inspect requests in Burp.

8. Examples (commands + tips) Authenticated scan (Basic): gobuster dir -u https://target.example.com/ -w wordlists/common.txt -t 20 -A "user:password" Scan behind Basic Auth. JSON output: gobuster dir -u https://target.example.com/ -w wordlists/common.txt -t 30 -o results.json -f Save full JSON for parsing. Wildcard DNS handling: gobuster dns -d example.com -w subdomains.txt -t 40 -r 8.8.8.8 -o dns_out.txt Query specific resolver; verify suspicious hits manually.

9. Applications (Use-cases) Web recon / content discovery (pentests, bug bounties) Subdomain discovery for attack surface mapping Integration in recon scripts and CI for asset discovery Combined use with Burp, Nuclei, scanners for validation

10. Limitations & Caveats Wildcard DNS causes false positives in DNS mode Aggressive scans trigger WAF/IDS — tune threads/delay Depends on wordlist quality; not intelligent response analysis Not ideal alone for large-scale DNS enumeration

11. References GitHub: https://github.com/OJ/gobuster (releases & docs) Wordlists: SecLists (github.com/danielmiessler/SecLists) Kali Tools & Tutorials: Kali docs, community writeups

12. Next steps / Extras Want a script to run safe scans against a lab VM? I can add it. I can also produce 4–5 screenshot-ready terminal runs for your video.