iwantcoding.com
🔥 Daily 👥 Rooms 🏆 Top Log in Sign up

Content Discovery

By · Reviewed & last updated · Part of Ethical Hacking Tutorial

Gobuster is a content-discovery tool used during authorised reconnaissance to enumerate directories, virtual hosts, DNS subdomains, S3 buckets, and Fuzz parameters. It is fast, single-binary, and noisy — every request shows up in logs. That last point matters: do not run it outside an engagement scope, and confirm rate limits with the client.

Authorised gobuster usage for an engagement

EXAMPLE
# 1) Rules of engagement (excerpt — must be signed before any run)
# - Target hosts:    target.lab.example.test, demo.example.test
# - Out of scope:    *.prod.example.com, anything not listed above
# - Window:          2026-06-11 09:00–17:00 AEST
# - Rate ceiling:    50 req/s aggregate to the target subnet
# - Stop conditions: any HTTP 5xx burst > 30s, client incident page, RoE end time
# - Reporting:       consolidated report within 5 business days

# 2) Pick a wordlist appropriate to the target. Default to a small, focused list
#    and only grow it if you have a defensible reason.
#    SecLists: https://github.com/danielmiessler/SecLists  (clone offline; do not curl mid-test)
DIR_LIST=/usr/share/SecLists/Discovery/Web-Content/common.txt
DNS_LIST=/usr/share/SecLists/Discovery/DNS/subdomains-top1million-5000.txt

# 3) Directory brute force on an HTTPS target
gobuster dir \
  -u https://target.lab.example.test \
  -w "$DIR_LIST" \
  -t 20                       \
  -k                          \
  --timeout 8s                \
  -b 404,400                  \
  -x php,aspx,html,js         \
  -o gobuster-dir.txt

# 4) DNS subdomain enumeration (resolver under your control)
gobuster dns \
  -d example.test \
  -w "$DNS_LIST" \
  -t 10 \
  -r 1.1.1.1                  \
  -o gobuster-dns.txt

# 5) VHost discovery (different sites on the same IP)
gobuster vhost \
  -u https://target.lab.example.test \
  -w "$DNS_LIST" \
  --append-domain \
  -t 10 \
  -o gobuster-vhost.txt

# 6) Fuzz a parameter or path segment with -u containing FUZZ
#    Use sparingly — this is far noisier than dir/dns mode.
gobuster fuzz \
  -u 'https://target.lab.example.test/api/items?id=FUZZ' \
  -w small-numeric-list.txt \
  -t 5

# 7) Post-run hygiene
#    - Save raw output, screenshots, and the wordlist version with each finding.
#    - Confirm rate ceiling was honoured (tail server logs together with the client).
#    - DELETE local copies of any sensitive responses; report by reference.

# 8) Findings template (Markdown, one per result)
cat <<'EOF'
## Finding: Directory listing on /backup
Severity:  Medium (information disclosure)
URL:       https://target.lab.example.test/backup/
Steps:     curl -k https://target.lab.example.test/backup/
Evidence:  Apache directory index lists 2026-04 db dumps (no contents fetched).
Fix:       Apache 'Options -Indexes' for /backup, or relocate behind authn.
EOF

Why it matters

Throttle threads (-t 5–20) and timeout aggressively so a misconfigured target does not get DoSed by your reconnaissance. The credibility of an engagement comes from being noisy in logs but harmless in impact — the opposite combination ends the engagement early.

Tip: Tweak the snippet with Try it Yourself », then sit the quiz at the bottom of the page.

Example

Example
# Content discovery on AUTHORISED web targets.
gobuster dir -u https://target.example -w /usr/share/wordlists/dirb/common.txt
# Modern alternatives: feroxbuster, ffuf.
ffuf -u https://target.example/FUZZ -w common.txt -mc 200,204,301,302,401,403
Try it Yourself »

Discussion

Loading…