NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cybersecurity
Gobuster & Directory Enumeration
Stop just looking at the homepage. Master the art of directory enumeration to uncover hidden admin panels, backup files, and forgotten web paths using Gobuster and SecLists.
Room tasks
1What is Directory Brute Forcing
2Gobuster Installation & Basic Usage
3Wordlists 101
4File Extension Fuzzing & Hidden Endpoints
5Ffuf - A Faster Alternative Fuzzer
6Guided Lab: Uncovering a Hidden Admin Panel
Frequently Asked Questions
What is Gobuster?
Gobuster is a command-line tool that brute-forces directories, files, and subdomains using wordlists. Testers use it to discover content that is not linked on a website.
Why does directory enumeration matter?
Hidden paths like admin panels, backups, and old scripts are often less protected than the main site. Finding them can expose sensitive data or new attack surface.
Which wordlists work with Gobuster?
SecLists offers many directory and file wordlists, and the right choice depends on the target. This beginner-friendly Codelivly room is free and shows how to pick and use them.