CheckOps home

Tools directory

G

CheckOps

Gobuster

Gobuster is an Apache-2.0 Go tool for brute-forcing directories and files, DNS subdomains, virtual hosts and cloud buckets during authorised testing.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

Gobuster is a directory/file, DNS and virtual-host busting tool written in Go. It is widely used in penetration testing for discovering hidden content and subdomains with wordlists.

The source code is at OJ/gobuster on GitHub under the Apache-2.0 licence, with about 14,300 stars; the most recent commit was on 10 November 2026.

Features

  1. Directory mode: Find hidden paths and files.
  2. DNS mode: Enumerate subdomains.
  3. Vhost mode: Discover virtual hosts.
  4. Cloud bucket modes: Check storage buckets; see README.
  5. Concurrency: Fast multi-threaded scanning.

Pros

  1. Free to use: Open source under Apache-2.0.
  2. Maintained: Commits as recent as 10 November 2026.
  3. Community: About 14,300 GitHub stars.

Cons

  1. Authorised use only: Only test systems you are permitted to.
  2. Less flexible than ffuf: Fewer filtering options for complex fuzzing.
gobuster dir -u https://staging.example.com -w wordlist.txt

Resources:

Pricing

Gobuster is free and open source under the Apache-2.0 licence.

  1. Penetration testers.
  2. Red teams with authorisation.
  3. Not a fit for CI security gates.

Conclusion

Gobuster is a fast, simple enumeration tool for paths, DNS and vhosts.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with Gobuster side by side.