Web Reconnaissance · Beginner Guide

Gobuster: DIR, DNS & VHOST Explained

Learn what Gobuster is, understand its three important modes, and practice the essential flags and commands used for directory discovery, DNS enumeration and virtual-host discovery.

Directory Discovery Subdomain Enumeration Virtual Hosts Kali Linux
Getting Started

What is Gobuster?

Gobuster is a command-line tool used during reconnaissance to discover hidden directories, files, DNS subdomains and virtual hosts.

Gobuster uses a wordlist, which is a file containing possible names. It tests those names against a target and reports matching results.

For example, if your wordlist contains admin, login and backup, Gobuster DIR can test paths such as https://example.com/admin.

DIR Find possible hidden files and directories.
DNS Discover subdomains through DNS queries.
VHOST Find hostnames recognized by a web server.
Important: Use these commands only on your own systems, practice labs or targets you have permission to test.
Mode 01

Gobuster DIR — Directory and File Discovery

Gobuster DIR checks a website for directories and files that might not appear in its navigation menu.

Suppose you are testing your own website https://example.com. Gobuster may try paths such as /admin, /login and /backup using a wordlist.

Gobuster directory discovery Gobuster tests admin, login and backup paths against a web server. Gobuster DIR Wordlist requests /admin /login /backup 403 200 404 Results HTTP responses Example responses, not a real scan

Important Gobuster DIR Flags

Flag Purpose Example
dir Start directory discovery gobuster dir
-u Target website URL -u https://example.com
-w Wordlist location -w common.txt
-x File extensions -x php,html,js
-t Concurrent threads -t 10
-o Save results to a file -o results.txt
--exclude-length Filter specific response lengths --exclude-length 1234

Important Gobuster DIR Commands

1. Basic directory discovery

Bash · Basic DIR 
gobuster dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt

-u specifies the website and -w specifies the wordlist.

2. Discover files with extensions

Bash · File Extensions 
gobuster dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt -x php,html,js,txt -t 10

-x tries file extensions such as .php and .html. -t 10 uses 10 concurrent threads.

3. Save discovered paths

Bash · Save Results 
gobuster dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt -t 10 -o dir-results.txt

Example Output

/admin (Status: 403) /login (Status: 200) /images (Status: 301) /backup (Status: 404)

200: Request succeeded.
301: Resource redirects.
403: Access denied.
404: Resource not found.

Remember: This is illustrative output. Gobuster normally filters 404 responses. A 200 or 403 response does not automatically mean you found a vulnerability.
Mode 02

Gobuster DNS — Subdomain Discovery

Gobuster DNS uses a wordlist to generate possible subdomains and checks whether they resolve through DNS.

For example, if your domain is example.com, Gobuster may check mail.example.com, dev.example.com and api.example.com.

Gobuster DNS subdomain discovery Gobuster generates possible subdomains and queries a DNS resolver for results. Gobuster DNS Subdomain wordlist Possible Names mail.example.com dev.example.com api.example.com DNS Resolver Checks records Wordlist → DNS queries → resolved names

Important Gobuster DNS Flags

Flag Purpose Example
dns Start DNS enumeration gobuster dns
-do Target domain in newer versions -do example.com
-w Subdomain wordlist -w subdomains.txt
-r Custom DNS resolver -r 8.8.8.8:53
-t Concurrent threads -t 10
-o Save results -o dns-results.txt

Important Gobuster DNS Commands

1. Basic subdomain discovery

Bash · Basic DNS 
gobuster dns -do example.com -w subdomains.txt

-do specifies the domain in newer Gobuster versions, while -w provides the subdomain wordlist.

2. Use a custom DNS resolver

Bash · Custom Resolver 
gobuster dns -do example.com -w subdomains.txt -r 8.8.8.8:53

-r chooses the resolver. 8.8.8.8 is a public DNS resolver, and 53 is the DNS port.

3. Save DNS results

Bash · Save Results 
gobuster dns -do example.com -w subdomains.txt -t 10 -o dns-results.txt

Example Output

Found: www.example.com Found: mail.example.com Found: api.example.com
Important: A DNS record does not guarantee that a website is running. DNS discovery and HTTP service discovery are different activities.
Mode 03

Gobuster VHOST — Virtual Host Discovery

A virtual host allows a web server to serve different websites based on the hostname used in an HTTP request.

For example, www.example.com, admin.example.com and dev.example.com can share the same server IP address.

Virtual host discovery Three hostnames connect to one web server using the same IP address. www.example.com admin.example.com dev.example.com Web Server One IP Address
Different hostnames can be configured on the same web server.

Gobuster VHOST tries possible hostnames against a web server and compares the responses to identify configured virtual hosts.

Important Gobuster VHOST Flags

Flag Purpose Example
vhost Start virtual-host discovery gobuster vhost
-u Target web server URL -u https://example.com
-w Wordlist location -w subdomains.txt
--append-domain Add the domain to each word --append-domain
-t Concurrent threads -t 10
-o Save results -o vhost-results.txt
--exclude-length Filter repeated response sizes --exclude-length 1234

Important Gobuster VHOST Commands

1. Basic virtual-host discovery

Bash · Basic VHOST 
gobuster vhost -u https://example.com -w subdomains.txt --append-domain

--append-domain converts a word such as admin into admin.example.com.

2. Save discovered virtual hosts

Bash · Save Results 
gobuster vhost -u https://example.com -w subdomains.txt --append-domain -t 10 -o vhost-results.txt

3. Filter repeated response lengths

Bash · Response Filter 
gobuster vhost -u https://example.com -w subdomains.txt --append-domain --exclude-length 1234
Remember: The number 1234 is only an example. First inspect the actual response lengths before filtering results. HTTPS and reverse proxies can also affect virtual-host testing.
Quick Revision

Three Gobuster Commands to Remember

DIR — Find directories and files

Gobuster DIR 
gobuster dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt -x php,html,js -t 10 -o dir-results.txt

DNS — Discover subdomains

Gobuster DNS 
gobuster dns -do example.com -w subdomains.txt -t 10 -o dns-results.txt

VHOST — Discover virtual hosts

Gobuster VHOST 
gobuster vhost -u https://example.com -w subdomains.txt --append-domain -t 10 -o vhost-results.txt

Before Running Gobuster

  • Check your installed version using gobuster version.
  • Use gobuster dns --help to verify DNS flags for your version.
  • Make sure your wordlist exists.
  • Start with a small wordlist and modest thread count.
  • Verify the results manually before reporting any finding.

Next: Practice Reconnaissance

Continue learning cybersecurity tools and practice these techniques in your own lab or an authorized testing environment.

Explore Cybersecurity Tools →