Post cover image

August 24, 2026

Gobuster: The Basics — TryHackMe Write-UpIntroduction

Introduction

By Shadow

6 min read

Gobuster: The Basics — TryHackMe Write-UpIntroduction

Introduction

Web applications often expose resources that are not directly linked from the main page. Directories, files, subdomains, and virtual hosts may exist on a web server without being immediately visible to a user.

This is where web enumeration becomes useful.

In this TryHackMe room, I explored Gobuster, a command-line tool commonly used for discovering hidden web resources during authorized security assessments.

The room introduces Gobuster's basic syntax, wordlists, directory and file enumeration, subdomain enumeration, and virtual host enumeration.

Platform: TryHackMe Room: Gobuster: The Basics Difficulty: Beginner Focus: Web Enumeration

1. What is Gobuster?

Gobuster is a command-line enumeration tool written in Go.

None

It can be used to discover resources such as:

  • Directories
  • Files
  • Subdomains
  • Virtual hosts

The basic idea is to provide Gobuster with a target and a wordlist.

Gobuster then takes entries from the wordlist and makes requests based on them.

A simplified workflow looks like this:

Wordlist
   ↓
Gobuster
   ↓
Target Web Server
   ↓
HTTP Requests
   ↓
Discovered Resources

For example, if a wordlist contains:

admin
login
images
backup

Gobuster can test whether resources corresponding to these names exist on the target.

2. Why Web Enumeration Matters

When performing a web application security assessment, the homepage is usually only one part of the application.

A web server might contain additional resources such as:

/admin
/login
/uploads
/backup
/config

Some of these resources may not be linked from the homepage.

Enumeration helps security testers build a better understanding of the application's attack surface.

Security relevance

Discovering hidden resources does not automatically mean they are vulnerable.

The purpose of enumeration is to identify what exists so that it can be investigated further.

3. Gobuster Help

Before using a command-line security tool, it is useful to understand its available options.

Gobuster provides a help menu:

gobuster --help

It can also provide help for a specific mode.

For example:

gobuster dir --help

This displays the options available for directory enumeration.

Reading the help output is an important habit because tool syntax and options can vary between versions.

4. Gobuster Modes

Gobuster provides different enumeration modes.

The room focuses on three important modes:

dir
dns
vhost

dir

Used for discovering directories and files on a web server.

dns

Used for DNS subdomain enumeration.

vhost

Used for discovering virtual hosts configured on a web server.

Each mode has a different purpose, but the underlying idea is similar: use a wordlist to test possible resources.

5. Directory Enumeration

One of the most common uses of Gobuster is directory enumeration.

The mode is:

dir

A basic structure is:

gobuster dir -u http://TARGET -w WORDLIST

Here:

  • dir selects directory enumeration
  • -u specifies the target URL
  • -w specifies the wordlist

For example:

gobuster dir -u http://TARGET -w wordlist.txt

Gobuster then tests words from the wordlist against the target.

6. Understanding Directory Enumeration

Suppose the wordlist contains:

admin
login
images
uploads
backup

Gobuster may test requests such as:

/admin
/login
/images
/uploads
/backup

If the server responds differently because a resource exists, Gobuster reports the result.

This can reveal directories that were not visible from the main website.

7. HTTP Status Codes

When enumerating a website, understanding HTTP status codes is important.

Some common examples include:

200 — OK

The requested resource was successfully returned.

301 — Moved Permanently

The requested resource redirects to another location.

302 — Found

The server redirects the client to another location.

403 — Forbidden

The server understood the request but refuses to provide access.

404 — Not Found

The requested resource does not exist.

Gobuster can display these status codes alongside discovered resources.

Security relevance

A 403 response can still be interesting during enumeration.

It may indicate that a resource exists even though direct access is currently forbidden.

8. File Enumeration

Gobuster can also search for files.

This can be done by specifying file extensions with the appropriate option.

For example:

gobuster dir -u http://TARGET -w wordlist.txt -x php,txt,html

The -x option tells Gobuster which extensions to test.

Instead of checking only:

/admin

Gobuster can also test:

/admin.php
/admin.txt
/admin.html

The exact extensions should depend on the technology being assessed.

9. Wordlists

Wordlists are a key component of Gobuster.

A wordlist contains potential names that Gobuster will test against the target.

For example:

admin
login
dashboard
uploads
images
backup

The larger and more relevant the wordlist, the more potential resources can be tested.

However, larger wordlists also mean more requests and potentially longer enumeration times.

Security perspective

A good penetration tester chooses wordlists based on the target rather than blindly using the largest available list.

For example, technology-specific or application-specific wordlists can sometimes produce better results.

10. Subdomain Enumeration

Web applications may use multiple subdomains.

For example:

www.example.com
admin.example.com
api.example.com
dev.example.com

Some subdomains may expose completely different applications or services.

Gobuster provides a DNS enumeration mode:

dns

A basic structure is:

gobuster dns -d example.com -w wordlist.txt

Here:

  • dns selects DNS enumeration
  • -d specifies the domain
  • -w specifies the wordlist

Gobuster then tests potential subdomain names.

11. Why Subdomain Enumeration Matters

Organizations often separate applications across different subdomains.

For example:

www.example.com
api.example.com
dev.example.com
mail.example.com

The main website may have strong security controls while another subdomain could expose a development application or administrative interface.

Therefore, discovering subdomains can significantly expand the known attack surface.

Important distinction

Finding a subdomain does not mean that it is vulnerable.

It simply gives the tester another asset to investigate.

12. Virtual Host Enumeration

Another concept covered by the room is Virtual Host (VHost) enumeration.

A single web server can host multiple websites.

The server can determine which website the client wants based on the HTTP Host header.

For example:

Host: www.example.com

could return one application, while:

Host: admin.example.com

could return another.

Gobuster provides the:

vhost

mode for this type of enumeration.

A basic structure is:

gobuster vhost -u http://example.com -w wordlist.txt

Gobuster tests potential virtual host names and analyzes the server's responses.

13. Subdomains vs Virtual Hosts

These two concepts are easy to confuse.

Subdomain Enumeration

Looks for DNS records such as:

admin.example.com
dev.example.com
api.example.com

The goal is to discover subdomains that resolve through DNS.

VHost Enumeration

Tests different hostnames against a web server to identify virtual hosts configured on that server.

A hostname may be configured on the web server even if it is not publicly listed as a normal DNS record.

Therefore, DNS enumeration and VHost enumeration can reveal different information.

14. Useful Gobuster Options

Some commonly used options include:

-u

Specifies the target URL.

-w

Specifies the wordlist.

-x

Specifies file extensions to test.

-t

Controls the number of concurrent threads.

-o

Saves the output to a file.

The available options depend on the Gobuster mode being used.

15. Enumeration Workflow

A simple web enumeration workflow can look like this:

Step 1 — Identify the target

Determine the authorized target URL or domain.

Step 2 — Choose a suitable wordlist

Select a wordlist appropriate for the target.

Step 3 — Enumerate directories

Use:

gobuster dir -u http://TARGET -w WORDLIST

Step 4 — Enumerate files

Add relevant extensions:

gobuster dir -u http://TARGET -w WORDLIST -x php,txt,html

Step 5 — Enumerate subdomains

Use DNS enumeration:

gobuster dns -d example.com -w WORDLIST

Step 6 — Test virtual hosts

Use:

gobuster vhost -u http://example.com -w WORDLIST

Step 7 — Investigate discoveries

After finding a resource, investigate it manually and determine whether it is expected, accessible, or potentially interesting from a security perspective.

16. Why Enumeration Should Come Before Exploitation

One of the most important lessons from this room is that enumeration should happen before attempting to exploit a target.

A tester needs to understand the attack surface first.

For example:

Reconnaissance
      ↓
Enumeration
      ↓
Identify Technologies
      ↓
Discover Resources
      ↓
Analyze Potential Issues
      ↓
Security Testing

Without proper enumeration, important resources may remain undiscovered.

17. Defensive Perspective

Gobuster is primarily an offensive-security tool, but understanding how it works is also useful for defenders.

Organizations can reduce exposure by:

  • Removing unnecessary files
  • Removing unused directories
  • Restricting administrative interfaces
  • Avoiding exposed backup files
  • Properly configuring virtual hosts
  • Monitoring unusual HTTP request patterns
  • Using appropriate access controls

For example, sensitive administrative interfaces should not be unnecessarily exposed to the public Internet.

Key Takeaways

After completing the Gobuster room, I learned:

  • What Gobuster is
  • Why web enumeration is important
  • How wordlists are used
  • How to enumerate directories
  • How to enumerate files
  • How HTTP status codes help identify resources
  • How to perform DNS subdomain enumeration
  • How virtual host enumeration works
  • The difference between subdomains and virtual hosts
  • How Gobuster options modify enumeration
  • Why enumeration should happen before exploitation
  • How defenders can reduce unnecessary web exposure

Conclusion

Gobuster is a useful enumeration tool for discovering resources that may not be immediately visible on a web application.

The room demonstrates three important areas of enumeration:

Directory/File Enumeration
        +
DNS Enumeration
        +
Virtual Host Enumeration

Understanding these techniques is an important part of web penetration testing because they help security professionals map an application's attack surface.

The most important lesson is that enumeration is about discovering and understanding the target before attempting further security testing.

Gobuster does not automatically identify vulnerabilities. Instead, it helps reveal resources that can then be analyzed manually or with other security tools.

Main lesson: a good penetration test starts with thorough enumeration because you cannot properly assess what you have not discovered.