gobuster dir -u https://example.com -w words.txt --rate-limit 100

gobuster vhost -u http://target.com -w wordlist.txt --append-domain

gobuster vhost -u https://example.com -w vhosts.txt \
  --domain example.com \
  --tls-sni \                   # NEW: force SNI
  --timeout 10s \
  --append-domain \             # automatically append domain to word
  --exclude-length 0,94         # filter out false positives by response length

gobuster [mode] -u <target> -w <wordlist> [flags]

Gobuster Commands Upd May 2026

Old approach used --delay 0.2 (seconds). Updated Gobuster introduces --rate-limit (requests per second):

gobuster dir -u https://example.com -w words.txt --rate-limit 100

This is more intuitive for modern rate‑limiting scenarios. gobuster commands upd

Many modern applications host multiple sites on a single IP address. "Dir" mode won't find these. You need to check the Host header. This is often where you find internal admin panels or hidden applications. Old approach used --delay 0

Note: Unlike directory scanning, vhost scanning returns many "200 OK" statuses even for non-existent hosts. You must filter by size (-b exclude by size). This is more intuitive for modern rate‑limiting scenarios

gobuster vhost -u http://target.com -w wordlist.txt --append-domain

Vhost discovery now supports HTTPS properly and SNI (Server Name Indication):

gobuster vhost -u https://example.com -w vhosts.txt \
  --domain example.com \
  --tls-sni \                   # NEW: force SNI
  --timeout 10s \
  --append-domain \             # automatically append domain to word
  --exclude-length 0,94         # filter out false positives by response length

gobuster [mode] -u <target> -w <wordlist> [flags]

Modes:

---

Gobuster is a powerful tool that can be used for various tasks, including web application discovery, vulnerability scanning, and penetration testing. Its versatility and customizability make it a popular choice among security professionals. By mastering Gobuster commands and options, you can improve your skills in web application security testing and vulnerability assessment.

Manage consent