Gobuster Cheat Sheet

Gobuster finds what isn't linked anywhere: forgotten admin panels, staging directories, old API versions, subdomains that never made it into the main DNS record set someone expected you to test.

Red Team / Offensive Use

Most of the value here isn't in the main application — it's in what a target forgot was still reachable. A /backup directory, a /api/v1 left behind after a /v2 migration, or a staging subdomain still pointing at production data are the kind of finds gobuster turns up that manual browsing never will. It's also a fast first move in bug bounty recon, where subdomain and content discovery often matters more than anything else.

Established Cheatsheet

Official gobuster GitHub repo — the authoritative source for current flags and modes; third-party cheat sheets go stale as the tool adds new modes, this doesn't.

PWNMI's Top 5 Use Cases

• gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt — standard directory/file brute force, the default starting point
• gobuster dir -u https://target.com -w <wordlist> -x php,txt,bak — same, but also checking specific file extensions — .bak and .old turn up more than you'd expect
• gobuster dns -d target.com -w <subdomain-wordlist> — subdomain enumeration; often the highest-value recon step in bug bounty specifically
• gobuster vhost -u https://target.com -w <wordlist> — virtual host discovery, for finding applications hosted on the same IP under a different hostname
• gobuster dir -u https://target.com -w <wordlist> -t 50 — increase thread count for speed; balance against not tripping rate-limiting or WAF rules

Next step

Combine findings here with Burp Suite — anything gobuster turns up is worth putting through Repeater next.