How to Use Gobuster: Practical Guide with Examples

In one line

Gobuster rapidly guesses the hidden pages, folders, and files on a website from a wordlist, so you can find the parts that are there but not linked anywhere.

What this is, for a beginner

Gobuster is a fast content-discovery tool. Given a target and a wordlist, it rapidly requests many possible paths and reports which ones exist, revealing directories, files, and endpoints that are present but not linked from anywhere you can see. Attackers and testers use it to map the hidden parts of a web application, which often include admin panels, backups, and forgotten functionality.

It has a few modes: directory and file brute forcing, subdomain (DNS) enumeration, and virtual-host discovery. The most common for beginners is directory mode, which walks a wordlist against a web server and shows the response for each guess. The quality of your wordlist matters as much as the tool.

The legal lab we use: Your own lab (DVWA / Juice Shop)

Run Gobuster only against web servers you own or are authorized to test, such as your local DVWA or Juice Shop. Brute-forcing others' sites can be treated as abuse.

Your own lab (DVWA / Juice Shop) project page →

Full walkthrough: exploiting it step by step

Step 1 — Pick a wordlist

Content discovery is only as good as the wordlist. A common starting point is a general directory list such as those in the SecLists collection.

terminal

ls /usr/share/wordlists/

Expected result: You have a path to a directory wordlist to feed Gobuster.

Step 2 — Run directory mode

Point Gobuster at your local lab in directory mode with the wordlist. It requests each path and reports those that return a meaningful status.

terminal

gobuster dir -u http://localhost:3000 -w /usr/share/wordlists/dirb/common.txt

Expected result: A list of discovered paths with their HTTP status codes, revealing directories and files that exist on the server.

Step 3 — Filter and extend with extensions

Add file extensions so Gobuster also checks for files, not just directories, which surfaces things like backup or configuration files.

terminal

gobuster dir -u http://localhost:3000 -w common.txt -x php,txt,bak

Expected result: Additional results appear for files with the given extensions, such as an exposed backup or text file.

Step 4 — Enumerate subdomains (on your own domain)

Switch to DNS mode to discover subdomains of a domain you own, using a subdomain wordlist. This maps a larger footprint than a single host.

terminal

gobuster dns -d yourdomain.com -w subdomains.txt

Expected result: Any resolvable subdomains from the wordlist are listed, expanding the map of your own infrastructure.

Step 5 — Investigate the finds

Discovery is only the start. Open the interesting paths and assess them; a discovered admin panel or backup file is where the real testing begins, connecting to the misconfiguration walkthrough.

Expected result: You triage the discovered content and identify which paths warrant deeper testing.

Free resource

Get the free 35-week ethical hacking roadmap

The exact order I'd learn this in, every vulnerability and tool, week by week, with the labs to practise each one. Enter your email and I'll send it over, plus one practical lesson each week.

How to detect and fix this

How to detect it

For defenders, content-discovery tools generate a burst of requests to many non-existent paths, producing a spike in 404 responses that is easy to alert on.
The results themselves show what is exposed; anything sensitive that Gobuster finds is a finding to remove or protect.
Rate limiting and web application firewalls can slow or block aggressive discovery.

How to fix it

Do not rely on obscurity: assume hidden paths will be found, and protect sensitive endpoints with authentication and authorization rather than by hoping nobody guesses them.
Remove backups, configuration files, and unused functionality from web-accessible locations.
Apply rate limiting and monitor for high-volume 404 patterns as an early sign of enumeration.
Return consistent responses so the tool cannot easily distinguish real from fake paths.

Common beginner mistakes

Using a poor wordlist and concluding a site is empty; the wordlist determines what you can find.
Ignoring status codes; a redirect or a forbidden response can be as interesting as a 200.
Running at high concurrency against a fragile lab and knocking it over; tune threads to the target.
Enumerating sites or domains you do not own, which can be treated as abuse; stick to your own.

FAQ

What is content discovery for?

It finds parts of a web application that exist but are not linked, such as admin panels, backups, old pages, and API endpoints. These hidden areas are often less protected and are a common route to real findings, which is why mapping them is an early step in testing.

How is Gobuster different from a spider or crawler?

A crawler follows links it can see, so it only finds what is reachable from the visible site. Gobuster guesses paths from a wordlist, so it finds unlinked content a crawler would never reach. They are complementary.

Does the wordlist really matter that much?

Yes. Gobuster only finds what is in the list, so a good, context-appropriate wordlist is the difference between finding the admin panel and finding nothing. Curating and choosing wordlists is a skill in itself.

Where to go from here

You just exploited one vulnerability in a lab. Here's the structured path.

Scattered tutorials teach you tricks; they don't make you a pentester. My mentorship is 35 weeks of exactly this, every vulnerability and tool in a deliberate order, on real labs, with one-on-one feedback on your work so your mistakes get caught early instead of becoming habits.

See the mentorship

Keep practising

How to Use Nikto How to Exploit Security Misconfiguration How to Use Nmap