小編給大家分享一下Gobuster是一款什么工具，希望大家閱讀完這篇文章之后都有所收獲，下面讓我們一起去探討吧！
成都創(chuàng)新互聯(lián)公司是一家集網站建設,仁和企業(yè)網站建設,仁和品牌網站建設,網站定制,仁和網站建設報價,網絡營銷,網絡優(yōu)化,仁和網站推廣為一體的創(chuàng)新建站企業(yè)，幫助傳統(tǒng)企業(yè)提升企業(yè)形象加強企業(yè)競爭力?？沙浞譂M足這一群體相比中小企業(yè)更為豐富、高端、多元的互聯(lián)網需求。同時我們時刻保持專業(yè)、時尚、前沿，時刻以成就客戶成長自我，堅持不斷學習、思考、沉淀、凈化自己，讓我們?yōu)楦嗟钠髽I(yè)打造出實用型網站。
Gobuster這款工具基于Go編程語言開發(fā)，廣大研究人員可使用該工具來對目錄、文件、DNS和VHost等對象進行暴力破解攻擊。目前，該工具剛剛發(fā)布了最新的Gobuster v3.0.1版本。
Gobuster可爆破的對象包括：
1、目標站點中的URI（目錄或文件）；
2、DNS子域名（支持通配符）；
3、目標Web服務器的虛擬主機名（VHost）；
1、沒有使用臃腫的Java GUI，工具基于FTW控制臺實現(xiàn)；
2、可直接在命令行工具中執(zhí)行；
3、不會執(zhí)行遞歸爆破；
4、允許測試人員同時對目標文件夾以及多種擴展進行爆破；
5、跨平臺支持；
6、運行速度比解釋型腳本的運行速度快；
7、不需要運行時環(huán)境；
8、并發(fā)性支持；
1、引入了新的命令行選項；
2、性能優(yōu)化，網絡連接更穩(wěn)定；
3、新增VHost名爆破支持；
4、可提供自定義的HTTP頭；
dir：傳統(tǒng)的目錄爆破模式；
dns：DNS子域名爆破模式；
vhost：虛擬主機爆破模式；
gobuster help：輸出完整的幫助信息
gobuster help
：輸出指定模塊的幫助信息
Usage:
gobuster dns [flags]
Flags:
d, --domain string The target domain
h, --help help for dns
r, --resolver string Use custom DNS server (format server.com or server.com:port)
c, --showcname Show CNAME records (cannot be used with '-i' option)
i, --showips Show IP addresses
--timeout duration DNS resolver timeout (default 1s)
--wildcard Force continued operation when wildcard found
Global Flags:
z, --noprogress Don't display progress
o, --output string Output file to write results to (defaults to stdout)
q, --quiet Don't print the banner and other noise
t, --threads int Number of concurrent threads (default 10)
--delay duration Time each thread waits between requests (e.g. 1500ms)
v, --verbose Verbose output (errors)
w, --wordlist string Path to the wordlist
Usage:
gobuster dir [flags]
Flags:
f, --addslash Append / to each request
c, --cookies string Cookies to use for the requests
e, --expanded Expanded mode, print full URLs
x, --extensions string File extension(s) to search for
r, --followredirect Follow redirects
H, --headers stringArray Specify HTTP headers, -H 'Header1: val1' -H 'Header2: val2'
h, --help help for dir
l, --includelength Include the length of the body in the output
k, --insecuressl Skip SSL certificate verification
n, --nostatus Don't print status codes
P, --password string Password for Basic Auth
p, --proxy string Proxy to use for requests [http(s)://host:port]
s, --statuscodes string Positive status codes (will be overwritten with statuscodesblacklist if set) (default "200,204,301,302,307,401,403")
b, --statuscodesblacklist string Negative status codes (will override statuscodes if set)
--timeout duration HTTP Timeout (default 10s)
u, --url string The target URL
a, --useragent string Set the User-Agent string (default "gobuster/3.0.1")
U, --username string Username for Basic Auth
--wildcard Force continued operation when wildcard found
Global Flags:
z, --noprogress Don't display progress
o, --output string Output file to write results to (defaults to stdout)
q, --quiet Don't print the banner and other noise
t, --threads int Number of concurrent threads (default 10)
--delay duration Time each thread waits between requests (e.g. 1500ms)
v, --verbose Verbose output (errors)
w, --wordlist string Path to the wordlist
Usage:
gobuster vhost [flags]
Flags:
c, --cookies string Cookies to use for the requests
r, --followredirect Follow redirects
H, --headers stringArray Specify HTTP headers, -H 'Header1: val1' -H 'Header2: val2'
h, --help help for vhost
k, --insecuressl Skip SSL certificate verification
P, --password string Password for Basic Auth
p, --proxy string Proxy to use for requests [http(s)://host:port]
--timeout duration HTTP Timeout (default 10s)
u, --url string The target URL
a, --useragent string Set the User-Agent string (default "gobuster/3.0.1")
U, --username string Username for Basic Auth
Global Flags:
z, --noprogress Don't display progress
o, --output string Output file to write results to (defaults to stdout)
q, --quiet Don't print the banner and other noise
t, --threads int Number of concurrent threads (default 10)
--delay duration Time each thread waits between requests (e.g. 1500ms)
v, --verbose Verbose output (errors)
w, --wordlist string Path to the wordlist
我們已經將項目的源碼發(fā)布到了Gobuster的GitHub主頁，廣大用戶目前無需自行構建項目代碼。
如果你已經搭建好了Go環(huán)境，你就可以直接使用下列命令來下載和安裝Gobuster：
go get github.com/OJ/gobuster
由于該工具采用Go語言開發(fā)，那么用戶首先就需要安裝Go語言環(huán)境和編譯器等等。關于Go環(huán)境的具體配置信息，可以參考Go語言的【官方網站】。
編譯
gobuster現(xiàn)在引入了外部依賴組件，所以我們需要先配置依賴組件：
go get && go build
該命令將會創(chuàng)建一份gobuster代碼，運行下列命令即可在$GOPATH/bin目錄中安裝：
go install
配置好所有的依賴組件之后，我們就可以使用代碼構建腳本了：
make - 使用當前Go配置來構建工具，例如“go build”；
make windows - 構建32位或64位Windows程序，并將其寫入build子目錄；
make linux - 構建32位或64位Linux程序，并將其寫入build子目錄；
make darwin - 構建32位或64位Darwin程序，并將其寫入build子目錄；
make all - 構建跨平臺程序，并將其寫入build子目錄；
make clean - 清理build子目錄；
make test - 運行測試；
字典文件可以直接通過stdin嵌入到gobuster：
hashcat -a 3 --stdout ?l | gobuster dir -u https://mysite.com -w -
命令行運行：
gobuster dir -u https://mysite.com/path/to/folder -c 'session=123456' -t 50 -w common-files.txt -x .php,.html
默認選項如下：
gobuster dir -u https://buffered.io -w ~/wordlists/shortlist.txt===============================================================Gobuster v3.0.1by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)===============================================================[+] Mode : dir[+] Url/Domain : https://buffered.io/[+] Threads : 10[+] Wordlist : /home/oj/wordlists/shortlist.txt[+] Status codes : 200,204,301,302,307,401,403[+] User Agent : gobuster/3.0.1[+] Timeout : 10s===============================================================2019/06/21 11:49:43 Starting gobuster===============================================================/categories (Status: 301)/contact (Status: 301)/posts (Status: 301)/index (Status: 200)===============================================================2019/06/21 11:49:44 Finished===============================================================
禁用狀態(tài)碼的默認選項：
gobuster dir -u https://buffered.io -w ~/wordlists/shortlist.txt -n===============================================================Gobuster v3.0.1by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)===============================================================[+] Mode : dir[+] Url/Domain : https://buffered.io/[+] Threads : 10[+] Wordlist : /home/oj/wordlists/shortlist.txt[+] Status codes : 200,204,301,302,307,401,403[+] User Agent : gobuster/3.0.1[+] No status : true[+] Timeout : 10s===============================================================2019/06/21 11:50:18 Starting gobuster===============================================================/categories/contact/index/posts===============================================================2019/06/21 11:50:18 Finished===============================================================
Verbose輸出：
gobuster dir -u https://buffered.io -w ~/wordlists/shortlist.txt -v===============================================================Gobuster v3.0.1by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)===============================================================[+] Mode : dir[+] Url/Domain : https://buffered.io/[+] Threads : 10[+] Wordlist : /home/oj/wordlists/shortlist.txt[+] Status codes : 200,204,301,302,307,401,403[+] User Agent : gobuster/3.0.1[+] Verbose : true[+] Timeout : 10s===============================================================2019/06/21 11:50:51 Starting gobuster===============================================================Missed: /alsodoesnotexist (Status: 404)Found: /index (Status: 200)Missed: /doesnotexist (Status: 404)Found: /categories (Status: 301)Found: /posts (Status: 301)Found: /contact (Status: 301)===============================================================2019/06/21 11:50:51 Finished===============================================================
顯示內容長度：
gobuster dir -u https://buffered.io -w ~/wordlists/shortlist.txt -l===============================================================Gobuster v3.0.1by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)===============================================================[+] Mode : dir[+] Url/Domain : https://buffered.io/[+] Threads : 10[+] Wordlist : /home/oj/wordlists/shortlist.txt[+] Status codes : 200,204,301,302,307,401,403[+] User Agent : gobuster/3.0.1[+] Show length : true[+] Timeout : 10s===============================================================2019/06/21 11:51:16 Starting gobuster===============================================================/categories (Status: 301) [Size: 178]/posts (Status: 301) [Size: 178]/contact (Status: 301) [Size: 178]/index (Status: 200) [Size: 51759]===============================================================2019/06/21 11:51:17 Finished===============================================================
命令行運行：
gobuster dns -d mysite.com -t 50 -w common-names.txt
運行樣例：
gobuster dns -d google.com -w ~/wordlists/subdomains.txt===============================================================Gobuster v3.0.1by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)===============================================================[+] Mode : dns[+] Url/Domain : google.com[+] Threads : 10[+] Wordlist : /home/oj/wordlists/subdomains.txt===============================================================2019/06/21 11:54:20 Starting gobuster===============================================================Found: chrome.google.comFound: ns1.google.comFound: admin.google.comFound: www.google.comFound: m.google.comFound: support.google.comFound: translate.google.comFound: cse.google.comFound: news.google.comFound: music.google.comFound: mail.google.comFound: store.google.comFound: mobile.google.comFound: search.google.comFound: wap.google.comFound: directory.google.comFound: local.google.comFound: blog.google.com===============================================================2019/06/21 11:54:20 Finished===============================================================
IP樣本運行：
gobuster dns -d google.com -w ~/wordlists/subdomains.txt -i===============================================================Gobuster v3.0.1by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)===============================================================[+] Mode : dns[+] Url/Domain : google.com[+] Threads : 10[+] Wordlist : /home/oj/wordlists/subdomains.txt===============================================================2019/06/21 11:54:54 Starting gobuster===============================================================Found: www.google.com [172.217.25.36, 2404:6800:4006:802::2004]Found: admin.google.com [172.217.25.46, 2404:6800:4006:806::200e]Found: store.google.com [172.217.167.78, 2404:6800:4006:802::200e]Found: mobile.google.com [172.217.25.43, 2404:6800:4006:802::200b]Found: ns1.google.com [216.239.32.10, 2001:4860:4802:32::a]Found: m.google.com [172.217.25.43, 2404:6800:4006:802::200b]Found: cse.google.com [172.217.25.46, 2404:6800:4006:80a::200e]Found: chrome.google.com [172.217.25.46, 2404:6800:4006:802::200e]Found: search.google.com [172.217.25.46, 2404:6800:4006:802::200e]Found: local.google.com [172.217.25.46, 2404:6800:4006:80a::200e]Found: news.google.com [172.217.25.46, 2404:6800:4006:802::200e]Found: blog.google.com [216.58.199.73, 2404:6800:4006:806::2009]Found: support.google.com [172.217.25.46, 2404:6800:4006:802::200e]Found: wap.google.com [172.217.25.46, 2404:6800:4006:802::200e]Found: directory.google.com [172.217.25.46, 2404:6800:4006:802::200e]Found: translate.google.com [172.217.25.46, 2404:6800:4006:802::200e]Found: music.google.com [172.217.25.46, 2404:6800:4006:802::200e]Found: mail.google.com [172.217.25.37, 2404:6800:4006:802::2005]===============================================================2019/06/21 11:54:55 Finished===============================================================
DNS通配符檢測：
gobuster dns -d 0.0.1.xip.io -w ~/wordlists/subdomains.txt===============================================================Gobuster v3.0.1by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)===============================================================[+] Mode : dns[+] Url/Domain : 0.0.1.xip.io[+] Threads : 10[+] Wordlist : /home/oj/wordlists/subdomains.txt===============================================================2019/06/21 12:13:48 Starting gobuster===============================================================2019/06/21 12:13:48 [-] Wildcard DNS found. IP address(es): 1.0.0.02019/06/21 12:13:48 [!] To force processing of Wildcard DNS, specify the '--wildcard' switch.===============================================================2019/06/21 12:13:48 Finished===============================================================
命令行運行：
gobuster vhost -u https://mysite.com -w common-vhosts.txt
常規(guī)樣本運行結果：
gobuster vhost -u https://mysite.com -w common-vhosts.txt===============================================================Gobuster v3.0.1by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)===============================================================[+] Url: https://mysite.com[+] Threads: 10[+] Wordlist: common-vhosts.txt[+] User Agent: gobuster/3.0.1[+] Timeout: 10s===============================================================2019/06/21 08:36:00 Starting gobuster===============================================================Found: www.mysite.comFound: piwik.mysite.comFound: mail.mysite.com===============================================================2019/06/21 08:36:05 Finished===============================================================
看完了這篇文章，相信你對“Gobuster是一款什么工具”有了一定的了解，如果想了解更多相關知識，歡迎關注創(chuàng)新互聯(lián)行業(yè)資訊頻道，感謝各位的閱讀！
重慶分公司
重慶分公司
