Alternatives to Gobuster
Check candidate web paths and network names during security testing. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Gobuster
Check candidate web paths and network names during security testing.
Replacements
Listings that take over the same core job as Gobuster.
Feroxbuster
Discover web content during an authorized application assessment.
Feroxbuster focuses on recursive web content discovery with configurable scanning, is MIT licensed, and drops Gobuster's extra discovery modes such as network names.
ffuf
Test variations in HTTP requests with a command-line fuzzer.
ffuf is an MIT-licensed general HTTP fuzzer with configurable matching and filtering, so it covers path discovery and other request variations beyond Gobuster's modes.
dirsearch
Web path scanner for discovering hidden directories and files.
dirsearch is a GPL-2.0 web path scanner with recursion, extension templates, filters, proxies and several report formats, but it only covers web paths.
Similar software
Related functionality, not a direct replacement.
SecLists
Find reusable test data for authorized security assessments.
Nikto
Web server scanner for risky files, outdated software and misconfigurations.
ZAP
Inspect and test web applications with the ZAP security proxy.
Burp Suite Community Edition
PortSwigger's free web security testing toolkit, for intercepting, inspecting and modifying HTTP traffic by hand.
Amass
OWASP tool that maps an organisation's external attack surface and assets.
theHarvester
Collect public information about domains during authorized research.
