> For the complete documentation index, see [llms.txt](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/gobuster.md).

# Gobuster

### Searching a Linux server

```
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u 10.10.10.56/cgi-bin/ -x sh,cgi
```

* `dir`: This is the mode of Gobuster you're using, which is for directory brute-forcing.
* `-w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt`: This is the `-w` flag followed by the path to the wordlist you want to use for the brute-force attack. In this case, you're using the wordlist located at `/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt`. This wordlist contains a list of common directory and file names that Gobuster will use to guess the paths on the target web server.
* `-u 10.10.10.56/cgi-bin/`: This is the `-u` flag followed by the base URL of the target web server. You're specifying the URL `http://10.10.10.56/cgi-bin/` as the starting point for the brute-force attack. Gobuster will then append the paths from the wordlist to this base URL and check if they exist on the server.
* `-x sh,cgi`: This is the `-x` flag followed by a comma-separated list of file extensions you want Gobuster to search for. In this case, you're telling Gobuster to search for files with the `.sh` and `.cgi` extensions in the directories it's scanning. If any directories or files with these extensions exist on the server, Gobuster will report them as findings.