Gobuster

v3.6OJ Reeves

Walks a wordlist against a web server to find directories and files that answer, resolves candidate subdomains, and probes virtual hosts. The range's Gobuster resolves every word against the authored path table for the service, so a hit is a path the scenario really serves.

Category: Web application security testing
Package: gobuster
Runs on: Linux · Windows
Commands: gobuster

Words are looked up in the authored web fixture. Misses are silent, hits report the fixture's real status and size. No request leaves the browser.

Install it

The scripts below install the real OJ Reeves package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-gobuster.sh

Windows installer (PowerShell)

Install-gobuster.ps1

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install Gobuster
```
sudo apt install -y gobuster
```

RHEL, Fedora (dnf)

Install Gobuster
```
sudo dnf install -y gobuster
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install Gobuster
```
sudo pacman -S --noconfirm gobuster
```

Alpine (apk)

Install Gobuster
```
sudo apk add gobuster
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which gobuster
```
Check the version
```
gobuster --version
```
The range reports 3.6.

Remove it

Take it off again
```
sudo apt remove --purge gobuster
```

On Windows

Windows Package Manager (winget)

Search the catalog
```
winget search gobuster
```
Install Gobuster
```
winget install --id gobuster -e
```
Package names drift between distributions; search first if this one misses.

Chocolatey (choco)

Install Gobuster
```
choco install gobuster -y
```
Run the shell as administrator.

Check it worked

Confirm it resolves
```
where gobuster
```
Check the version
```
gobuster --version
```
The range reports 3.6.

Remove it

Take it off again
```
winget uninstall --id gobuster
```

Inside the range

Tick it on the launch screen
Under Gobuster's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y gobuster
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Gobuster

Pentest: External Recon to FootholdEnumerate a customer's public perimeter from an approved scan window, chain a stale service to a foothold, and file the first finding with CVSS and remediation before you touch anything else.
Pentest: Web App Assessment (OWASP Top 10)Assess a storefront with the Burp-lite workbench at /pentest/proxy: repeat a login, fuzz an id parameter, catch an IDOR and a stored XSS, and file each finding under its OWASP Top 10 category.