Test with GoBuster! (Powerful bruteforcing tool of golang)

by hahwul 2 min read

directory 스캔 도구의 dirbuster가 아주 강세였습니다만, 올해부터 gobuster가 더 많이쓰이는 것 같은 느낌이 듭니다. 당연히 스캔 도구는 이젠 golang이 압도적일겁니다. (고루틴과 고채널의 힘이란..) The directory scan tool’s dirbuster has been very strong, but it feels like gobuster going to be more popular this year. Of course, now the scanners are going to be dominated by golang.

오늘은 golang으로 만들어진 gobuster에 대한 이야기를 하려고 합니다. Today I’m going to write about a gobuster made of golang.

Install gobuster

go get을 이용하여 설치해줍시다. 덤으로 alias 설정까지 해주면 더더욱 베스트.

go get github.com/OJ/gobuster


# check gobuster path and copy
ls ~/go/bin/gobuster
/Users/hahwul/go/bin/gobuster

# edit your terminal rc (zsh, bash, etc..)
vim ~/.zshrc

alias gobuster='/Users/hahwul/go/bin/gobuster'

# reload rc file
source ~/.zshrc

run gobuster

gobuster
Usage:
  gobuster [command]

Available Commands:
  dir         Uses directory/file brutceforcing mode
  dns         Uses DNS subdomain bruteforcing mode
  help        Help about any command
  vhost       Uses VHOST bruteforcing mode

Flags:
      --delay duration    Time each thread waits between requests (e.g. 1500ms)
  -h, --help              help for gobuster
  -z, --noprogress        Don't display progress
  -o, --output string     Output file to write results to (defaults to stdout)
  -q, --quiet             Don't print the banner and other noise
  -t, --threads int       Number of concurrent threads (default 10)
  -v, --verbose           Verbose output (errors)
  -w, --wordlist string   Path to the wordlist

Use "gobuster [command] --help" for more information about a command.

gobuster scanning mode?

gobuster는 총 3가지의 모드를 지원합니다. dirdnsvhost 이며 각각 항목들에 대해 bruteforcing이 가능합니다. The gobuster supports a total of three modes: It is ‘dir’, ‘dns’ and ‘vhost’ and each item can be bruteforcing.

dir         Uses directory/file brutceforcing mode
dns         Uses DNS subdomain bruteforcing mode
vhost       Uses VHOST bruteforcing mode

dir은 url(-u) 와 wordlist(-w)가 필수 파라미터입니다. The dir url wordlist and (-u) (-w) required parameters.

dns는 domain(-d) 와 wordlist(-w)가 필수 파라미터입니다. The dns domain wordlist and (-d) (-w) required parameters.

vhost는 url(-u) 와 wordlist(-w)가 필수 파라미터입니다. The vhost url wordlist and (-u) (-w) required parameters.

Finding directory and file using gobuster

gobuster dir -u https://www.hahwul.com -w Discovery/Web-Content/common.txt


===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            https://www.hahwul.com
[+] Threads:        10
[+] Wordlist:       Discovery/Web-Content/common.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Timeout:        10s
===============================================================
2019/12/26 01:59:03 Starting gobuster
===============================================================
/1000 (Status: 200)
/1001 (Status: 200)
/1990 (Status: 200)
/1994 (Status: 200)
/1992 (Status: 200)
.......
snip...

Finding Subdomain using gobuster

gobuster dns -d hahwul.com -w ./Discovery/DNS/subdomains-top1million-5000.txt


===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Domain:     hahwul.com
[+] Threads:    10
[+] Timeout:    1s
[+] Wordlist:   ./Discovery/DNS/subdomains-top1million-5000.txt
===============================================================
2019/12/26 01:56:35 Starting gobuster
===============================================================
Found: localhost.hahwul.com
Found: www.hahwul.com
Found: test.hahwul.com
Found: phoenix.hahwul.com
Found: WWW.hahwul.com
===============================================================
2019/12/26 01:57:08 Finished
===============================================================

Using Pipeline

-z(progress 출력하지 않음) -q(배너를 출력하지 않음) -o(결과 파일저장) 를 이용하면 충분히 pipeline에도 사용할 수 있습니다. -z(no progress output) -q(no banner output) -o(save result file) is sufficient for pipeline.

gobuster dns -d hahwul.com -w ./Discovery/DNS/subdomains-top1million-5000.txt -z -q -o out.txt

cat out.txt
Found: www.hahwul.com
Found: localhost.hahwul.com
Found: test.hahwul.com
Found: phoenix.hahwul.com
Found: WWW.hahwul.com

이전에도 Amass와 Subjack을 이용한 Takeover 체크에 대한 글을 썼었는데, 참고해보면 좋은 아이디어가 많이 나올 것 같아요. I wrote about the check the subdomain takeover using Amass and SubJack. You see this, have any idea of testing.

Wordlist?

I used SecList! https://github.com/danielmiessler/SecLists