How to Install and Use Gobuster in Linux for Directory and DNS Brute-Forcing

Auditing web server deployments, validating API endpoints, and assessing security postures require discovering unlinked assets, administrative portals, backup files, and hidden subdomains. While web crawlers and search engine spiders map visible hyperlinks, they cannot discover unlinked directories (such as /admin/, /backup.tar.gz, or /api/v2/internal/) or unadvertised DNS subdomains.

Gobuster is a high-performance open-source reconnaissance tool written in Go. Renowned for its multi-threaded speed and minimal resource footprint, Gobuster excels at brute-forcing web paths, discovering DNS subdomains, uncovering virtual hosts (VHosts), and scanning Amazon S3 and Google Cloud storage buckets using wordlists. This tutorial explains how to install Gobuster on Linux, choose and structure wordlists, brute-force web directories, and enumerate DNS subdomains.

Gobuster Operational Modes Overview

Gobuster organises its scanning functionality into distinct execution modes:

• dir: Classic HTTP/HTTPS directory and file brute-forcing mode.
• dns: DNS subdomain enumeration mode, resolving candidate names against authoritative nameservers.
• vhost: Virtual host brute-forcing mode, testing whether specific Host headers resolve to separate virtual sites on the same IP.
• s3: Enumerate public Amazon Web Services S3 buckets.
• gcs: Enumerate public Google Cloud Storage buckets.

Installing Gobuster on Linux

Because Gobuster is written in Go, it can be installed via distribution package managers, pre-compiled binaries, or compiled directly from source.

Method 1: Install via Package Managers

Ubuntu and Debian (including Kali Linux and Parrot OS):

sudo apt update
sudo apt install gobuster

Arch Linux:

sudo pacman -S gobuster

Fedora:

sudo dnf install gobuster

Method 2: Install via Go

If you have Go installed on your machine:

go install github.com/OJ/gobuster/v3@latest

Confirm the installation by verifying the version flag:

gobuster version

Obtaining Wordlists for Scanning

Gobuster requires a dictionary file (wordlist) of common directory or subdomain names. The industry standard collection is SecLists:

sudo apt install seclists

Wordlists are stored under /usr/share/seclists/ or /usr/share/wordlists/dirb/common.txt.

Brute-Forcing Web Directories and Files (dir Mode)

To scan a target web server for hidden paths:

gobuster dir -u http://192.168.1.100 -w /usr/share/wordlists/dirb/common.txt

Key Flags for Directory Enumeration:

• -x <extensions>: Search for specific file extensions alongside directories (e.g. -x php,html,txt,json,bak).
• -t <threads>: Number of concurrent HTTP threads (default is 10; set to 30 or 50 for fast local networks).
• -s <codes>: Positive status codes to display (default: 200,204,301,302,307,401,403).
• -b <codes>: Negative status codes to ignore (e.g. -b 404,403).
• -k: Skip TLS/SSL certificate verification for self-signed development environments.

Example of an advanced scan targeting PHP scripts and backup archives:

gobuster dir -u https://example.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,zip,bak -t 30 -k -o scan-results.txt

Brute-Forcing DNS Subdomains (dns Mode)

To discover unadvertised subdomains (such as dev.example.com or vpn.example.com):

gobuster dns -d example.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t 30

You can optionally specify a custom public DNS resolver to avoid overloading your local router:

gobuster dns -d example.com -w subdomains.txt -r 1.1.1.1

Brute-Forcing Virtual Hosts (vhost Mode)

Modern web servers frequently host multiple websites on a single IP address by routing based on the HTTP Host header. To discover hidden virtual hosts without DNS records:

gobuster vhost -u http://192.168.1.50 -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain

Performance Comparison Across Flags

Adjusting concurrency and timeout settings ensures accurate scanning without crashing fragile web targets:

Setting	Recommended Value	Impact on Target
Low Speed / Stealth	-t 5 --delay 200ms	Minimal CPU load; avoids triggering rate limiters (WAF)
Standard Balanced	-t 20	Standard scanning rate for enterprise internal networks
High Throughput	-t 50 -k	Rapid discovery on local labs and container networks