目录/文件/DNS/VHost暴力破解工具：Gobuster-晓白博客网

Gobuster

Gobuster是用于暴力破解的工具，基于Go编写，使用CLI交互式，具有良好的性能优化和连接处理，提供自定义HTTP标头的选项等。

Gobuster安装

提供两种方式

直接下载编辑好的二进制文件 releases ，推荐
自行编译

自行编译

go get github.com/OJ/gobuster go get && go build go install

1 2 3

go get github . com / OJ / gobuster go get && go build go install

如果已经具有所有依赖项，则可以使用构建脚本：

make - 为当前的Go配置构建 (运行 go build)
make windows - 为Windows构建32位和64位二进制文件，并将其写入build子文件夹
make linux - 为Linux构建32位和64位二进制文件，并将其写入build子文件夹
make darwin - 为darwin构建32位和64位二进制文件，并将它们写入build子文件夹
make all - 为所有平台和体系结构构建，并将生成的二进制文件写入build子文件夹
make clean - 清除build子文件夹
make test - 运行测试

Gobuster使用

可用模式

dir - 经典目录暴力破解模式
dns - DNS子域暴力破解模式
vhost - 虚拟主机强制模式（与DNS不同！）

内置帮助

gobuster help - 输出顶级帮助。
gobuster help <mode> - 输出特定于该模式的帮助。

使用字典

可以通过向-w选项应用字典传递到gobuster中：

hashcat -a 3 --stdout ?l | gobuster dir -u https://mysite.com -w -

1	hashcat - a 3 -- stdout ? l \| gobuster dir - u https : //mysite.com -w -

`dir` 模式

gobuster dir -u https://mysite.com/path/to/folder -c 'session=123456' -t 50 -w common-files.txt -x .php,.html

1	gobuster dir - u https : //mysite.com/path/to/folder -c 'session=123456' -t 50 -w common-files.txt -x .php,.html

详细输出如下所示：

gobuster dir -u https://buffered.io -w ~/wordlists/shortlist.txt -v =============================================================== Gobuster v3.0.1 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_) =============================================================== [+] Mode : dir [+] Url/Domain : https://buffered.io/ [+] Threads : 10 [+] Wordlist : /home/oj/wordlists/shortlist.txt [+] Status codes : 200,204,301,302,307,401,403 [+] User Agent : gobuster/3.0.1 [+] Verbose : true [+] Timeout : 10s =============================================================== 2019/06/21 11:50:51 Starting gobuster =============================================================== Missed: /alsodoesnotexist (Status: 404) Found: /index (Status: 200) Missed: /doesnotexist (Status: 404) Found: /categories (Status: 301) Found: /posts (Status: 301) Found: /contact (Status: 301) =============================================================== 2019/06/21 11:50:51 Finished ===============================================================

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

gobuster dir - u https : //buffered.io -w ~/wordlists/shortlist.txt -v === === === === === === === === === === === === === === === === === === === === === Gobuster v3 . 0.1 by OJ Reeves ( @ TheColonial ) & Christian Mehlmauer ( @ _FireFart_ ) === === === === === === === === === === === === === === === === === === === === === [ + ] Mode : dir [ + ] Url / Domain : https : //buffered.io/ [ + ] Threads : 10 [ + ] Wordlist : / home / oj / wordlists / shortlist . txt [ + ] Status codes : 200 , 204 , 301 , 302 , 307 , 401 , 403 [ + ] User Agent : gobuster / 3.0.1 [ + ] Verbose : true [ + ] Timeout : 10s === === === === === === === === === === === === === === === === === === === === === 2019 / 06 / 21 11 : 50 : 51 Starting gobuster === === === === === === === === === === === === === === === === === === === === === Missed : / alsodoesnotexist ( Status : 404 ) Found : / index ( Status : 200 ) Missed : / doesnotexist ( Status : 404 ) Found : / categories ( Status : 301 ) Found : / posts ( Status : 301 ) Found : / contact ( Status : 301 ) === === === === === === === === === === === === === === === === === === === === === 2019 / 06 / 21 11 : 50 : 51 Finished === === === === === === === === === === === === === === === === === === === === ===

`dns` 模式

gobuster dns -d mysite.com -t 50 -w common-names.txt

1	gobuster dns - d mysite . com - t 50 - w common - names . txt

标准输出：

gobuster dns -d google.com -w ~/wordlists/subdomains.txt =============================================================== Gobuster v3.0.1 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_) =============================================================== [+] Mode : dns [+] Url/Domain : google.com [+] Threads : 10 [+] Wordlist : /home/oj/wordlists/subdomains.txt =============================================================== 2019/06/21 11:54:20 Starting gobuster =============================================================== Found: chrome.google.com Found: ns1.google.com Found: admin.google.com Found: www.google.com Found: m.google.com Found: support.google.com Found: translate.google.com Found: cse.google.com Found: news.google.com Found: music.google.com Found: mail.google.com Found: store.google.com Found: mobile.google.com Found: search.google.com Found: wap.google.com Found: directory.google.com Found: local.google.com Found: blog.google.com =============================================================== 2019/06/21 11:54:20 Finished ===============================================================

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34

gobuster dns - d google . com - w ~ / wordlists / subdomains . txt === === === === === === === === === === === === === === === === === === === === === Gobuster v3 . 0.1 by OJ Reeves ( @ TheColonial ) & Christian Mehlmauer ( @ _FireFart_ ) === === === === === === === === === === === === === === === === === === === === === [ + ] Mode : dns [ + ] Url / Domain : google . com [ + ] Threads : 10 [ + ] Wordlist : / home / oj / wordlists / subdomains . txt === === === === === === === === === === === === === === === === === === === === === 2019 / 06 / 21 11 : 54 : 20 Starting gobuster === === === === === === === === === === === === === === === === === === === === === Found : chrome . google . com Found : ns1 . google . com Found : admin . google . com Found : www . google . com Found : m . google . com Found : support . google . com Found : translate . google . com Found : cse . google . com Found : news . google . com Found : music . google . com Found : mail . google . com Found : store . google . com Found : mobile . google . com Found : search . google . com Found : wap . google . com Found : directory . google . com Found : local . google . com Found : blog . google . com === === === === === === === === === === === === === === === === === === === === === 2019 / 06 / 21 11 : 54 : 20 Finished === === === === === === === === === === === === === === === === === === === === ===

`vhost` 模式

gobuster vhost -u https://mysite.com -w common-vhosts.txt

1	gobuster vhost - u https : //mysite.com -w common-vhosts.txt

标准输出：

gobuster vhost -u https://mysite.com -w common-vhosts.txt =============================================================== Gobuster v3.0.1 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_) =============================================================== [+] Url: https://mysite.com [+] Threads: 10 [+] Wordlist: common-vhosts.txt [+] User Agent: gobuster/3.0.1 [+] Timeout: 10s =============================================================== 2019/06/21 08:36:00 Starting gobuster =============================================================== Found: www.mysite.com Found: piwik.mysite.com Found: mail.mysite.com =============================================================== 2019/06/21 08:36:05 Finished ===============================================================

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

gobuster vhost - u https : //mysite.com -w common-vhosts.txt === === === === === === === === === === === === === === === === === === === === === Gobuster v3 . 0.1 by OJ Reeves ( @ TheColonial ) & Christian Mehlmauer ( @ _FireFart_ ) === === === === === === === === === === === === === === === === === === === === === [ + ] Url : https : //mysite.com [ + ] Threads : 10 [ + ] Wordlist : common - vhosts . txt [ + ] User Agent : gobuster / 3.0.1 [ + ] Timeout : 10s === === === === === === === === === === === === === === === === === === === === === 2019 / 06 / 21 08 : 36 : 00 Starting gobuster === === === === === === === === === === === === === === === === === === === === === Found : www . mysite . com Found : piwik . mysite . com Found : mail . mysite . com === === === === === === === === === === === === === === === === === === === === === 2019 / 06 / 21 08 : 36 : 05 Finished === === === === === === === === === === === === === === === === === === === === ===