Gobuster v0.2 (OJ Reeves @TheColonial)

Alternative directory and file busting tool written in Go.

Oh dear God.. WHY!?

Because I wanted:

... something that didn't have a fat Java GUI (console FTW).
... to build something that just worked on the command line.
... something that did not do recursive brute force.
... something that allowed me to brute for folders and multiple extensions at once.
... something that compiled to native on multiple platforms.
... something that was faster than an interpreted script (such as Python).
... something that didn't require a runtime.
... use something that was good with concurrency (hence Go).
... to build something in Go that wasn't totally useless.

But it's shit! And your implementation sucks!

Yes, you're probably correct. Feel free to :

Not use it.
Show me how to do it better.

Command line options

-c=<http cookies> - use this to specify any cookies that you might need (simulating auth).
-f=<true|false> - set to true if you want to append / for directory brute forces.
-s=<status codes> - comma-separated set of the list of status codes to be deemed a "positive" (default: 200,204,301,302,307).
-t=<threads> - number of threads to run (default: 10).
-u=<url> - full to the folder to brute force, including scheme.
-v=<true|false> - verbose output.
-w=<wordlist> - path to the wordlist used for brute forcing.
-x=<extensions> - list of extensions to check for, if any.

Examples

Command line might look like this:

$ ./gobuster -u=https://mysite.com/path/to/folder '-c=session=123456' -t=50 -w=common-files.txt -x=.php,.html

Sample run goes like this:

./gobuster -w=words.txt -u=http://buffered.io/ -x=.html -v=true                                                ◼
Gobuster v0.2 (OJ Reeves @TheColonial)
======================================
[+] Url          : http://buffered.io/
[+] Threads      : 10
[+] Wordlist     : words.txt
[+] Status codes : 301,302,307,200,204
[+] Extensions   : .html
[+] Dislpay all  : true
======================================
Found: /index (200)
Found: /index.html (200)
Result: /posts (404)
Found: /contact (200)
Result: /contact.html (404)
Result: /posts.html (404)

License

See the LICENSE file.