Gobuster
Last updated
Last updated
Related Pages:
Download:
Dir : Specifies directory busting
-u : specifies target domain
-w : wordlist
-x: Specifies file extensions to look for
-t: specifies thread count
-k: ignore certificate checks
You can also scan for files by including the extensions to search for:
There are a couple of things you need to prepare to brute force Host headers:
Target Identification: First, identify the target web server's IP address. This can be done through DNS lookups or other reconnaissance techniques.
Wordlist Preparation: Prepare a wordlist containing potential virtual host names. You can use a pre-compiled wordlist, such as SecLists, or create a custom one based on your target's industry, naming conventions, or other relevant information.
The gobuster command to bruteforce vhosts generally looks like this:
The -u flag specifies the target URL (replace <target_IP_address> with the actual IP).
The -w flag specifies the wordlist file (replace <wordlist_file> with the path to your wordlist).
The --append-domain flag appends the base domain to each word in the wordlist.
In newer versions of Gobuster, the --append-domain flag is required to append the base domain to each word in the wordlist when performing virtual host discovery. This flag ensures that Gobuster correctly constructs the full virtual hostnames, which is essential for the accurate enumeration of potential subdomains. In older versions of Gobuster, this functionality was handled differently, and the --append-domain flag was not necessary. Users of older versions might not find this flag available or needed, as the tool appended the base domain by default or employed a different mechanism for virtual host generation.
Gobuster will output potential virtual hosts as it discovers them. Analyze the results carefully, noting any unusual or interesting findings. Further investigation might be needed to confirm the existence and functionality of the discovered virtual hosts.
There are a couple of other arguments that are worth knowing:
Consider using the -t flag to increase the number of threads for faster scanning.
The -k flag can ignore SSL/TLS certificate errors.
You can use the -o flag to save the output to a file for later analysis.
Virtual host discovery can generate significant traffic and might be detected by intrusion detection systems (IDS) or web application firewalls (WAF). Exercise caution and obtain proper authorization before scanning any targets.
Use vhost to specify subdomains:
If you see you are getting hundreds of successful results, you can filter out the length of the most common ones with --exclude-length:
-w: Wordlist (/usr/share/seclist/Discovery/DNS/(subdomainlists)
-u: domain
--append-domain: need to tell gobuster where to add the word from the wordlists (word).thetoppers.htb
--exclude-length: Specify the response size you want to exclude from the results
Run a sub-domain scan on a website:
