Tools & Commands · Ethical Hacking Tools
Gobuster
Web testing · Intermediate
A discovery tool that tries names from a wordlist to find web directories, virtual hosts, or DNS names on a target you are allowed to assess.
It asks a server about many possible names and shows which ones exist. That is useful for an authorized inventory of forgotten pages, and harmful when aimed at someone else's site.
Example: An authorized test reports that /staff responded with status 200. The team checks whether that page should be public.
Git in the Zone explains security tools and attack terminology so you can recognize them and defend against them. Practice only on systems you own or have written permission to test. Nothing on this site runs a command or an exploit.
What it is for
Find directories, virtual hosts, or DNS names using a wordlist during an authorized test.
Authorized use: Use it only on systems you own or have written permission to test. Git in the Zone explains the tool; it does not launch it.
Operating systems: Windows, Linux, and macOS.
Language you will see
- wordlist
- status code
- virtual host
How to read the options
- Wordlist: A file of candidate names. The quality of the list changes what the test can find.
- Status code: The server's numeric response. 200, 301, and 403 mean different things and all need interpretation.
Common misconception
- A status code of 200 means the server returned a page. It does not mean the content is safe to publish or that you may change it.