Gobuster

Gobuster is a tool to dirbust/Bruteforce websites. The options are fairly simple, here are the most important flags:

  -t, --threads int       Number of concurrent threads (default 10)
  -v, --verbose           Verbose output (errors)
  -w, --wordlist string   Path to the wordlist
  -u, --url string        The target URL
  -x, --extensions        If you want to you can set many extensions like php or txt which will 
						  be appended to the strings in the wordlist during the scan.

However keep in mind that to dirbust a website you need to use this command:

gobuster dir ...

There are other commands like dns or fuzz for DNS Subdomain Enumeration and Fuzzing respectively. If you want to dirbust simply add the needed flags after the command and start. For the wordlist I would recommend using one of these two wordlists:

/usr/share/dirbuster/wordlists/directory-list-2.3-small.txt
/usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt

They are quite large so you might want to look for something smaller but so far they found the interesting directories in a few minutes. To increase the speed I would use approximately 30 threads. Anything above that could block access to the website.

Here is an example that will scan the website http://ignition.htb with the specified wordlist using 30 Threads and will send queries with the strings from the wordlist. It will append once the .php extenstion and then send the same query again with the .txt extension instead.

gobuster dir -u http://ignition.htb -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt -t 30 -x php txt

Sources

GitHub