https://cybertoolchain.io/tools/gobuster New releases and features in gobuster, tracked by The Cyber Toolchain. en Mon, 30 Jun 2025 15:46:52 GMT https://github.com/OJ/gobuster/releases/tag/v3.7.0 https://github.com/OJ/gobuster/releases/tag/v3.7.0 Mon, 30 Jun 2025 15:46:52 GMT Gobuster v3.7.0 adds Host header fuzzing, TLS renegotiation, TCP DNS, interface binding, and vhost exclusion filters. • Adds `--check-cname` flag in DNS mode (replaces `--show-cname`) to check CNAME records. • Introduces `--debug` flag replacing `--verbose` for detailed logging, including logging of HTTP requests when enabled. • Supports fuzzing the Host header in fuzz mode for broader header-level attack surface coverage. • Adds `--interface` and `--local-ip` parameters to bind outgoing HTTP requests to a specific network interface or IP. • Adds support for TLS renegotiation during HTTPS scans. • Supports TCP protocol on DNS servers in DNS mode (previously UDP-only). • Allows excluding specific status codes and response lengths in vhost mode for cleaner result filtering. • Warns in vhost mode when `--append-domain` may have been forgotten, reducing common misconfiguration errors. • Warns when using vhost mode with a proxy and HTTP-based URLs where behavior may be unexpected. • Comments in wordlists (lines starting with `#`) are no longer silently ignored — they are now treated as entries. • Automatically disables progress output when stdout is redirected, enabling clean pipeline integration. • Adds `automaxprocs` support for accurate CPU limit detection when running inside Docker containers. • The `version` command now displays build variables for richer environment diagnostics. Breaking changes: • The `--show-cname` flag in DNS mode is renamed to `--check-cname`; any scripts or aliases using `--show-cname` will break. • The `--verbose` flag is removed and replaced by `--debug`; any scripts using `--verbose` will break. • Comments in wordlists (lines starting with `#`) are no longer ignored and will be treated as words to enumerate; wordlists relying on `#` comments for exclusion will produce unexpected entries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gobuster https://github.com/OJ/gobuster/releases/tag/v3.6.0 https://github.com/OJ/gobuster/releases/tag/v3.6.0 Mon, 14 Aug 2023 08:30:05 GMT gobuster v3.6.0 adds --wordlist-offset, multiple values for --exclude-length, and --no-fqdn flag • Adds `--wordlist-offset` parameter to skip N lines from the wordlist in all modes. • Allows multiple values and ranges on `--exclude-length` filter (e.g., `200,404-499`). • Adds `--no-fqdn` flag to DNS bruteforce mode to disable system search domain resolution. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gobuster https://github.com/OJ/gobuster/releases/tag/v3.3.0 https://github.com/OJ/gobuster/releases/tag/v3.3.0 Sat, 29 Oct 2022 14:40:21 GMT gobuster v3.3.0 adds mtls, POST/fuzzing support and new flags for ext loading, body/headers fuzzing, and header canonicalization. • Support TLS client certificates / mtls • support loading extensions from file • support fuzzing POST body, HTTP headers and basic auth • new option to not canonicalize header names Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gobuster https://github.com/OJ/gobuster/releases/tag/v3.2.0 https://github.com/OJ/gobuster/releases/tag/v3.2.0 Sat, 08 Oct 2022 16:54:07 GMT Adds Google Cloud bucket enumeration, TLS validation toggle for S3, color output, and Go 1.19 upgrade to gobuster v3.2.0. • Added google cloud bucket enumeration support • Added `notlsvalidation` option to S3 mode • Added color output capability • Upgraded base requirement to Go 1.19 Breaking changes: • Removed the wildcard flag from all modes except DNS Full history on Cyber Toolchain: https://cybertoolchain.io/tools/gobuster