当前位置: 首页 > 工具软件 > gobuster > 使用案例 >

GOBUSTER - 目录/文件和DNS爆破工具。

田柏
2023-12-01

github:https://github.com/OJ/gobuster

常用命令行选项

  • -fw - 使用通配符结果强制处理域。
  • -np - 隐藏进度输出。
  • -m <mode>- 使用哪种模式,dir或者dns(默认:) dir
  • -q - 禁用横幅/下划线输出。
  • -t <threads>- 要运行的线程数(默认值:) 10
  • -u <url/domain> - 完整URL(包括方案)或基本域名。
  • -v - 详细输出(显示所有结果)。
  • -w <wordlist>- 用于暴力强制的wordlist的路径(-用于stdin)。

dns模式的命令行选项

  • -cn - 显示CNAME记录(不能与'-i'选项一起使用)。
  • -i - 显示结果的所有IP地址。

dir模式的命令行选项

  • -a <user agent string> - 指定要在请求标头中发送的用户代理字符串。
  • -c <http cookies> - 使用它来指定您可能需要的任何cookie(模拟身份验证)。
  • -e - 指定呈现完整URL的扩展模式。
  • -f- 附加/目录暴力。
  • -k - 跳过SSL证书的验证。
  • -l - 显示响应的长度。
  • -n - “无状态”模式,禁用结果状态代码的输出。
  • -o <file> - 指定要将输出写入的文件名。
  • -p <proxy url> - 指定用于所有请求的代理(方案与URL方案非常匹配)。
  • -r - 按照重定向。
  • -s <status codes>- 逗号分隔的状态代码列表集合被视为“正面”(默认值:) 200,204,301,302,307
  • -x <extensions> - 要检查的扩展名列表(如果有)。
  • -P <password> - HTTP授权密码(仅限基本身份验证,如果缺少则提示)。
  • -U <username> - HTTP授权用户名(仅限基本身份验证)。
  • -to <timeout> - HTTP超时。示例:10s,100ms,1m(默认值:10s)。

建造

由于此工具是用Go编写的,因此您需要安装Go语言/编译器/等。有关安装和设置的完整详细信息,请访问Go语言网站。安装后,您有两个选择。

编译

gobuster 现在有外部依赖,所以他们需要先被拉入:

gobuster $ go get && go build

这将为您创建gobuster二进制文件。如果要将其安装在$GOPATH/bin可以运行的文件夹中:

gobuster $ go install

如果您已经拥有所有依赖项,则可以使用构建脚本:

  • make- 为当前Go配置构建(即运行go build)。
  • make windows- 为Windows构建32位和64位二进制文​​件,并将它们写入build子文件夹。
  • make linux- 为linux构建32位和64位二进制文​​件,并将它们写入build子文件夹。
  • make darwin- 为darwin构建32位和64位二进制文​​件,并将它们写入build子文件夹。
  • make all- 为所有平台和体系结构构建,并将生成的二进制文件写入build子文件夹。
  • make clean- 清除build子文件夹。
  • make test - 运行测试。

作为脚本运行

gobuster $ go run main.go <parameters>

通过STDIN进行单词列表

生词能够管道输送到gobuster通过stdin通过提供--w选项:

hashcat -a 3 --stdout ?l | gobuster -u https://mysite.com -w -

注意:如果-w选项与STDIN的管道同时指定,则会显示错误,程序将终止。

例子

dir 模式

命令行可能如下所示:

$ gobuster -u https://mysite.com/path/to/folder -c 'session=123456' -t 50 -w common-files.txt -x .php,.html

默认选项如下所示:

$ gobuster -u https://buffered.io -w ~/wordlists/shortlist.txt

=====================================================
Gobuster v2.0.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dir
[+] Url/Domain   : https://buffered.io/
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/shortlist.txt
[+] Status codes : 200,204,301,302,307,403
[+] Timeout      : 10s
=====================================================
2018/08/27 11:49:43 Starting gobuster
=====================================================
/categories (Status: 301)
/contact (Status: 301)
/posts (Status: 301)
/index (Status: 200)
=====================================================
2018/08/27 11:49:44 Finished
=====================================================

禁用状态代码的默认选项如下所示:

$ gobuster -u https://buffered.io -w ~/wordlists/shortlist.txt -n

=====================================================
Gobuster v2.0.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dir
[+] Url/Domain   : https://buffered.io/
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/shortlist.txt
[+] Status codes : 200,204,301,302,307,403
[+] No status    : true
[+] Timeout      : 10s
=====================================================
2018/08/27 11:50:18 Starting gobuster
=====================================================
/categories
/contact
/index
/posts
=====================================================
2018/08/27 11:50:18 Finished
=====================================================

详细输出如下所示:

$ gobuster -u https://buffered.io -w ~/wordlists/shortlist.txt -v

=====================================================
Gobuster v2.0.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dir
[+] Url/Domain   : https://buffered.io/
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/shortlist.txt
[+] Status codes : 200,204,301,302,307,403
[+] Verbose      : true
[+] Timeout      : 10s
=====================================================
2018/08/27 11:50:51 Starting gobuster
=====================================================
Missed: /alsodoesnotexist (Status: 404)
Found: /index (Status: 200)
Missed: /doesnotexist (Status: 404)
Found: /categories (Status: 301)
Found: /posts (Status: 301)
Found: /contact (Status: 301)
=====================================================
2018/08/27 11:50:51 Finished
=====================================================

显示内容长度的示例:

$ gobuster -u https://buffered.io -w ~/wordlists/shortlist.txt -l

=====================================================
Gobuster v2.0.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dir
[+] Url/Domain   : https://buffered.io/
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/shortlist.txt
[+] Status codes : 200,204,301,302,307,403
[+] Show length  : true
[+] Timeout      : 10s
=====================================================
2018/08/27 11:51:16 Starting gobuster
=====================================================
/categories (Status: 301) [Size: 178]
/posts (Status: 301) [Size: 178]
/contact (Status: 301) [Size: 178]
/index (Status: 200) [Size: 51759]
=====================================================
2018/08/27 11:51:17 Finished
=====================================================

安静的输出,状态禁用和扩展模式看起来像这样(“grep模式”):

$ gobuster -u https://buffered.io -w ~/wordlists/shortlist.txt -q -n -e
https://buffered.io/index
https://buffered.io/contact
https://buffered.io/posts
https://buffered.io/categories

dns 模式

命令行可能如下所示:

$ gobuster -m dns -u mysite.com -t 50 -w common-names.txt

正常的样本运行如下:

$ gobuster -m dns -w ~/wordlists/subdomains.txt -u google.com

=====================================================
Gobuster v2.0.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dns
[+] Url/Domain   : google.com
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/subdomains.txt
=====================================================
2018/08/27 11:54:20 Starting gobuster
=====================================================
Found: chrome.google.com
Found: ns1.google.com
Found: admin.google.com
Found: www.google.com
Found: m.google.com
Found: support.google.com
Found: translate.google.com
Found: cse.google.com
Found: news.google.com
Found: music.google.com
Found: mail.google.com
Found: store.google.com
Found: mobile.google.com
Found: search.google.com
Found: wap.google.com
Found: directory.google.com
Found: local.google.com
Found: blog.google.com
=====================================================
2018/08/27 11:54:20 Finished
=====================================================

显示IP示例运行如下:

$ gobuster -m dns -w ~/wordlists/subdomains.txt -u google.com -i

=====================================================
Gobuster v2.0.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dns
[+] Url/Domain   : google.com
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/subdomains.txt
=====================================================
2018/08/27 11:54:54 Starting gobuster
=====================================================
Found: www.google.com [172.217.25.36, 2404:6800:4006:802::2004]
Found: admin.google.com [172.217.25.46, 2404:6800:4006:806::200e]
Found: store.google.com [172.217.167.78, 2404:6800:4006:802::200e]
Found: mobile.google.com [172.217.25.43, 2404:6800:4006:802::200b]
Found: ns1.google.com [216.239.32.10, 2001:4860:4802:32::a]
Found: m.google.com [172.217.25.43, 2404:6800:4006:802::200b]
Found: cse.google.com [172.217.25.46, 2404:6800:4006:80a::200e]
Found: chrome.google.com [172.217.25.46, 2404:6800:4006:802::200e]
Found: search.google.com [172.217.25.46, 2404:6800:4006:802::200e]
Found: local.google.com [172.217.25.46, 2404:6800:4006:80a::200e]
Found: news.google.com [172.217.25.46, 2404:6800:4006:802::200e]
Found: blog.google.com [216.58.199.73, 2404:6800:4006:806::2009]
Found: support.google.com [172.217.25.46, 2404:6800:4006:802::200e]
Found: wap.google.com [172.217.25.46, 2404:6800:4006:802::200e]
Found: directory.google.com [172.217.25.46, 2404:6800:4006:802::200e]
Found: translate.google.com [172.217.25.46, 2404:6800:4006:802::200e]
Found: music.google.com [172.217.25.46, 2404:6800:4006:802::200e]
Found: mail.google.com [172.217.25.37, 2404:6800:4006:802::2005]
=====================================================
2018/08/27 11:54:55 Finished
=====================================================

基域无法解析时的基本域验证警告。如果用户在键入域时发胖,则这是一个警告而不是失败。

$ gobuster -m dns -w ~/wordlists/subdomains.txt -u yp.to -i

=====================================================
Gobuster v2.0.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dns
[+] Url/Domain   : yp.to
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/subdomains.txt
=====================================================
2018/08/27 11:56:43 Starting gobuster
=====================================================
2018/08/27 11:56:53 [-] Unable to validate base domain: yp.to
Found: cr.yp.to [131.193.32.108, 131.193.32.109]
=====================================================
2018/08/27 11:56:53 Finished
=====================================================

还可以正确检测到通配符DNS:

$ gobuster -m dns -w ~/wordlists/subdomains.txt -u 0.0.1.xip.io        

=====================================================
Gobuster v2.0.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dns
[+] Url/Domain   : 0.0.1.xip.io
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/subdomains.txt
=====================================================
2018/08/27 12:13:48 Starting gobuster
=====================================================
2018/08/27 12:13:48 [-] Wildcard DNS found. IP address(es): 1.0.0.0
2018/08/27 12:13:48 [!] To force processing of Wildcard DNS, specify the '-fw' switch.
=====================================================
2018/08/27 12:13:48 Finished
=====================================================

如果用户想要强制处理具有通配符条目的域,请使用-fw

$ gobuster -m dns -w ~/wordlists/subdomains.txt -u 0.0.1.xip.io -fw

=====================================================
Gobuster v2.0.1              OJ Reeves (@TheColonial)
=====================================================
[+] Mode         : dns
[+] Url/Domain   : 0.0.1.xip.io
[+] Threads      : 10
[+] Wordlist     : /home/oj/wordlists/subdomains.txt
=====================================================
2018/08/27 12:13:51 Starting gobuster
=====================================================
2018/08/27 12:13:51 [-] Wildcard DNS found. IP address(es): 1.0.0.0
Found: 127.0.0.1.xip.io
Found: test.127.0.0.1.xip.io
=====================================================
2018/08/27 12:13:53 Finished
=====================================================
 类似资料: