OJ/gobuster — a backend project — sits at 14.0k GitHub stars in the Backend space. Directory/File, DNS and VHost busting tool written in Go
Snapshot summary built from the project's own GitHub metadata — there's no written TopGit review yet. The page will update automatically when a full review is published.
WHY NO REVIEW YET
TopGit writes full reviews for the most-starred, most-requested repositories. This page is a snapshot until then — see the READ ME tab for the original README in full.
A fast and flexible brute-forcing tool written in Go
Gobuster is a high-performance directory/file, DNS and virtual host brute-forcing tool written in Go. It's designed to be fast, reliable, and easy to use for security professionals and penetration testers.
✨ Features
🚀 High Performance: Multi-threaded scanning with configurable concurrency
Download pre-compiled binaries from the releases page.
Using Docker
# Pull the latest image
docker pull ghcr.io/oj/gobuster:latest
# Run gobuster in Docker
docker run --rm -it ghcr.io/oj/gobuster:latest dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt
Building from Source
git clone https://github.com/OJ/gobuster.git
cd gobuster
go mod tidy
go build
Troubleshooting Installation
If you encounter issues:
Ensure Go version 1.24+ is installed: go version
Check your $GOPATH and $GOBIN environment variables
Verify $GOPATH/bin is in your $PATH
🎯 Usage
Gobuster uses a mode-based approach. Each mode is designed for specific enumeration tasks:
gobuster [mode] [options]
Getting Help
gobuster help # Show general help
gobuster help [mode] # Show help for specific mode
gobuster [mode] --help # Alternative help syntax
📊 Available Modes
🌐 Directory Mode (dir)
Enumerate directories and files on web servers.
Basic Usage:
gobuster dir -u https://example.com -w wordlist.txt
Advanced Options:
# With file extensions
gobuster dir -u https://example.com -w wordlist.txt -x php,html,js,txt
# With custom headers and cookies
gobuster dir -u https://example.com -w wordlist.txt -H "Authorization: Bearer token" -c "session=value"
# Show response length
gobuster dir -u https://example.com -w wordlist.txt -l
# Filter by status codes
gobuster dir -u https://example.com -w wordlist.txt -s 200,301,302
🔍 DNS Mode (dns)
Discover subdomains through DNS resolution.
Basic Usage:
gobuster dns -do example.com -w wordlist.txt
Advanced Options:
# Use custom DNS server
gobuster dns -do example.com -w wordlist.txt -r 8.8.8.8:53
# Increase threads for faster scanning
gobuster dns -do example.com -w wordlist.txt -t 50
If you're backing us already, you rock. If you're not, that's cool too! Want to back us? Become a backer!
All funds that are donated to this project will be donated to charity. A full log of charity donations will be available in this repository as they are processed.
💡 Common Use Cases
Web Application Security Testing
# Comprehensive directory enumeration
gobuster dir -u https://target.com -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,asp,aspx,jsp
# API endpoint discovery
gobuster dir -u https://api.target.com -w /usr/share/wordlists/dirb/common.txt -x json
# Admin panel discovery
gobuster dir -u https://target.com -w admin-panels.txt -s 200,301,302,403
Increase thread count with -t flag (but be careful not to overwhelm the target)
Use smaller, more targeted wordlists
🎯 Best Practices
Security Testing Guidelines
Always get proper authorization before testing any target
Start with low thread counts to avoid overwhelming servers
Use appropriate wordlists for the target technology
Respect rate limits and implement delays if needed
Monitor your network traffic to avoid detection
Wordlist Selection
For web applications: Use technology-specific wordlists (PHP, ASP.NET, etc.)
For APIs: Focus on common API endpoints and versioning patterns
For DNS: Use subdomain-specific wordlists with common patterns
For cloud storage: Use company/brand-specific patterns
Output Management
# Save results to file
gobuster dir -u https://example.com -w wordlist.txt -o results.txt
# Use quiet mode for clean output
gobuster dir -u https://example.com -w wordlist.txt -q
Remember: Always test responsibly and with proper authorization.
Changes
3.8.2
3.8.2
Fix expanded mode to show the full url again
3.8.1
3.8.1
Fix expanded mode showing the entries twice
3.8
3.8
Add exclude-hostname-length flag to dynamically adjust exclude-length by @0xyy66
Fix Fuzzing query parameters
Add --force flag in dir mode to continue execution if precheck errors occur
3.7
3.7
use new cli library
a lot more short options due to the new cli library
more user friendly error messages
clean up DNS mode
renamed show-cname to check-cname in dns mode
got rid of verbose flag and introduced debug instead
the version command now also shows some build variables for more info
switched to another pkcs12 library to support p12s generated with openssl3 that use SHA256 HMAC
comments in wordlists (strings starting with #) are no longer ignored
warn in vhost mode if the --append-domain switch might have been forgotten
allow to exclude status code and length in vhost mode
added automaxprocs for use in docker with cpu limits
log http requests with debug enabled
allow fuzzing of Host header in fuzz mode
automatically disable progress output when output is redirected
fix extra special characters when run with --no-progress
warn when using vhost mode with a proxy and http based urls as this might not work as expected
add interface and local-ip parameters to specify the outgoing interface for http requests
add support for tls renegotiation
fix progress with patterns by @acammack
fix backup discovery by @acammack
support tcp protocol on dns servers
add support for URL query parameters
3.6
3.6
Wordlist offset parameter to skip x lines from the wordlist
prevent double slashes when building up an url in dir mode
allow for multiple values and ranges on --exclude-length
no-fqdn parameter on dns bruteforce to disable the use of the systems search domains. This should speed up the run if you have configured some search domains. https://github.com/OJ/gobuster/pull/418
3.5
3.5
Allow Ranges in status code and status code blacklist. Example: 200,300-305,404
3.4
3.4
Enable TLS1.0 and TLS1.1 support
Add TFTP mode to search for files on tftp servers
3.3
3.3
Support TLS client certificates / mtls
support loading extensions from file
support fuzzing POST body, HTTP headers and basic auth
new option to not canonicalize header names
3.2
3.2
Use go 1.19
use contexts in the correct way
get rid of the wildcard flag (except in DNS mode)
color output
retry on timeout
google cloud bucket enumeration
fix nil reference errors
3.1
3.1
enumerate public AWS S3 buckets
fuzzing mode
specify HTTP method
added support for patterns. You can now specify a file containing patterns that are applied to every word, one by line. Every occurrence of the term {GOBUSTER} in it will be replaced with the current wordlist item. Please use with caution as this can cause increase the number of requests issued a lot.
The shorthand p flag which was assigned to proxy is now used by the pattern flag
3.0
3.0
New CLI options so modes are strictly separated (-m is now gone!)
Performance Optimizations and better connection handling
The most recent commit recorded on OJ/gobuster was 14 days ago, based on the GitHub push timestamp. The repository has 1.6k forks — one of the better signals of community interest.
How many stars does OJ/gobuster have?
OJ/gobuster has 14.0k GitHub stars — refresh the page for the live number, or check github.com/OJ/gobuster. TopGit mirrors GitHub's count but does not claim minute-by-minute accuracy.
What else is in the Backend space?
OJ/gobuster is tracked by TopGit under the Backend category, alongside 5 GitHub-tagged topics. Trending and Topics pages list peer repositories of comparable stars and language.
What language is OJ/gobuster written in?
OJ/gobuster is written primarily in Go. GitHub's language field is based on the largest share of bytes in the default branch.
What topics is OJ/gobuster associated with?
GitHub's repository topics for OJ/gobuster: "dns", "go", "pentesting", "tool", "web". TopGit's editorial category is Backend.
Where do I read more about OJ/gobuster?
This TopGit page is a snapshot — the READ ME tab shows the project's own README content (links stripped, images preserved). The GitHub repository at github.com/OJ/gobuster is the definitive source.
Why is OJ/gobuster categorized under Backend?
TopGit places OJ/gobuster in the Backend category based on its GitHub topics and description (tagged: "dns", "go", "pentesting"). Categories are assigned from real repository metadata, not editorial guesswork.
Read full README in the tab above.
Want a second opinion on gobuster?
Ask an AI that can read this page — one click and you get its take on gobuster.
/gobuster
