Skip to content
Open

3.8.3 #602

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
70 commits
Select commit Hold shift + click to select a range
f1726da
Bump golang.org/x/term from 0.34.0 to 0.35.0
dependabot[bot] Sep 8, 2025
d3cd3bb
Merge pull request #595 from OJ/dependabot/go_modules/dev/golang.org/…
github-actions[bot] Sep 8, 2025
db967aa
message
firefart Sep 10, 2025
3d6dee6
feat: add the ability to use regex to inspect the response body
mewajda Sep 15, 2025
acedf3c
feat: add regex inverted
mewajda Sep 18, 2025
9c87f96
fix: various modifications from review
mewajda Sep 19, 2025
7fd4a79
Bump hadolint/hadolint-action from 3.2.0 to 3.3.0
dependabot[bot] Sep 22, 2025
ae90482
Merge pull request #601 from OJ/dependabot/github_actions/dev/hadolin…
github-actions[bot] Sep 22, 2025
9bc78fc
Merge pull request #599 from mewajda/feat-regex
firefart Sep 28, 2025
9a5cf49
cleanup code
firefart Sep 28, 2025
2bf4568
update
firefart Sep 28, 2025
23eb90f
readme
firefart Sep 28, 2025
c59c447
update
firefart Sep 28, 2025
8583fbb
update vhs
firefart Sep 28, 2025
13e0b1a
update
firefart Sep 28, 2025
91703b7
update
firefart Sep 28, 2025
aae70eb
update
firefart Sep 28, 2025
aa3f08f
update
firefart Sep 28, 2025
ced860e
add body output dir
firefart Sep 28, 2025
66f23cc
Bump golang.org/x/term from 0.35.0 to 0.36.0
dependabot[bot] Oct 13, 2025
6461b6f
Merge pull request #605 from OJ/dependabot/go_modules/dev/golang.org/…
github-actions[bot] Oct 13, 2025
620cc4c
Fix #610
firefart Oct 30, 2025
f19b0d7
update
firefart Oct 30, 2025
8c13a5b
Allow comma in Header values via CLI
firefart Oct 31, 2025
88666c9
chore: update dependencies [automated]
firefart Nov 9, 2025
aee5a6e
Bump golangci/golangci-lint-action from 8 to 9
dependabot[bot] Nov 10, 2025
61561f8
Merge pull request #612 from OJ/dependabot/github_actions/dev/golangc…
firefart Nov 10, 2025
d27d87d
chore: update dependencies [automated]
firefart Nov 12, 2025
cff4b34
chore: update dependencies [automated]
firefart Nov 20, 2025
50ec1e4
Bump actions/checkout from 5 to 6
dependabot[bot] Nov 20, 2025
bd93b1b
Merge pull request #614 from OJ/dependabot/github_actions/dev/actions…
firefart Nov 21, 2025
71761dc
Merge remote-tracking branch 'origin/master' into dev
firefart Nov 21, 2025
8bfb300
Bump stefanzweifel/git-auto-commit-action from 5 to 7
dependabot[bot] Nov 21, 2025
c13280a
Bump actions/checkout from 4 to 6
dependabot[bot] Nov 21, 2025
0f086d5
Merge pull request #615 from OJ/dependabot/github_actions/dev/stefanz…
firefart Nov 21, 2025
eb73183
Merge pull request #616 from OJ/dependabot/github_actions/dev/actions…
firefart Nov 21, 2025
5b7d7d9
Update method flag description
atalatable Dec 2, 2025
768afdb
Merge branch 'dev' into master
firefart Dec 2, 2025
a5b65f2
Merge pull request #619 from atalatable/master
firefart Dec 2, 2025
620ff79
Fix formatting for body-output-dir flag
firefart Dec 2, 2025
eeb7edb
Bump golang.org/x/term from 0.37.0 to 0.38.0
dependabot[bot] Dec 8, 2025
117c881
Merge pull request #620 from OJ/dependabot/go_modules/dev/golang.org/…
firefart Dec 8, 2025
cd0f400
chore: update dependencies [automated]
firefart Dec 9, 2025
2a54cfd
chore: update dependencies [automated]
firefart Dec 23, 2025
e46a1cd
Bump dependabot/fetch-metadata from 2.4.0 to 2.5.0
dependabot[bot] Jan 5, 2026
5545413
Merge pull request #628 from OJ/dependabot/github_actions/dev/dependa…
firefart Jan 5, 2026
6187994
chore: update dependencies [automated]
firefart Jan 9, 2026
ffbdd2d
chore: update dependencies [automated]
firefart Jan 10, 2026
e133b19
chore: update dependencies [automated]
firefart Jan 13, 2026
3f61b81
Merge remote-tracking branch 'origin/master' into dev
firefart Jan 13, 2026
9a59c46
chore: update dependencies [automated]
firefart Feb 9, 2026
b5b1581
chore: update dependencies [automated]
firefart Feb 10, 2026
9eb6eb8
Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0
dependabot[bot] Feb 23, 2026
99cc67d
Merge pull request #635 from OJ/dependabot/github_actions/dev/gorelea…
firefart Feb 23, 2026
608c938
lint
firefart Feb 23, 2026
3637493
chore: update dependencies [automated]
firefart Feb 26, 2026
f1d49e3
chore: update dependencies [automated]
firefart Feb 27, 2026
26ed236
Bump docker/login-action from 3 to 4
dependabot[bot] Mar 4, 2026
fc40744
Bump docker/setup-qemu-action from 3 to 4
dependabot[bot] Mar 4, 2026
0ce810a
Merge pull request #636 from OJ/dependabot/github_actions/dev/docker/…
firefart Mar 5, 2026
0b169b5
Merge pull request #637 from OJ/dependabot/github_actions/dev/docker/…
firefart Mar 5, 2026
df3d15a
Bump docker/setup-buildx-action from 3 to 4
dependabot[bot] Mar 5, 2026
31007a9
Bump docker/build-push-action from 6 to 7
dependabot[bot] Mar 6, 2026
5ad7ffe
Merge pull request #639 from OJ/dependabot/github_actions/dev/docker/…
firefart Mar 6, 2026
0cdba68
Merge pull request #638 from OJ/dependabot/github_actions/dev/docker/…
firefart Mar 6, 2026
664746c
chore: update dependencies [automated]
firefart Mar 9, 2026
fd0b169
chore: update dependencies [automated]
firefart Mar 12, 2026
1f9081f
chore: update dependencies [automated]
firefart Mar 21, 2026
a7f5b58
Bump dependabot/fetch-metadata from 2.5.0 to 3.0.0
dependabot[bot] Mar 26, 2026
7fb6455
Merge pull request #640 from OJ/dependabot/github_actions/dev/dependa…
firefart Mar 27, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/auto-merge-dependabot.yml
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ jobs:
steps:
- name: Dependabot metadata
id: metadata
uses: dependabot/fetch-metadata@v2.4.0
uses: dependabot/fetch-metadata@v3.0.0
with:
github-token: "${{ secrets.GITHUB_TOKEN }}"

Expand Down
10 changes: 5 additions & 5 deletions .github/workflows/docker.yml
Original file line number Diff line number Diff line change
Expand Up @@ -17,23 +17,23 @@ jobs:

steps:
- name: checkout sources
uses: actions/checkout@v5
uses: actions/checkout@v6

- name: Set up QEMU
uses: docker/setup-qemu-action@v3
uses: docker/setup-qemu-action@v4

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@v4

- name: Login to GitHub Container Registry
uses: docker/login-action@v3
uses: docker/login-action@v4
with:
registry: ghcr.io
username: ${{ github.repository_owner }}
password: ${{ secrets.GITHUB_TOKEN }}

- name: Build and push
uses: docker/build-push-action@v6
uses: docker/build-push-action@v7
with:
push: true
platforms: linux/amd64,linux/arm/v7,linux/arm64/v8,linux/386,linux/ppc64le
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/go.yml
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@v5
uses: actions/checkout@v6

- name: Set up Go
uses: actions/setup-go@v6
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/golangci-lint.yml
Original file line number Diff line number Diff line change
Expand Up @@ -8,14 +8,14 @@ jobs:
timeout-minutes: 30
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: actions/checkout@v6

- uses: actions/setup-go@v6
with:
go-version: "stable"

- name: golangci-lint
uses: golangci/golangci-lint-action@v8
uses: golangci/golangci-lint-action@v9
with:
version: latest
args: --timeout=5m
4 changes: 2 additions & 2 deletions .github/workflows/hadolint.yml
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,8 @@ jobs:
name: hadolint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: hadolint/hadolint-action@v3.2.0
- uses: actions/checkout@v6
- uses: hadolint/hadolint-action@v3.3.0
with:
dockerfile: Dockerfile
# DL3007: Using latest is prone to errors if the image will ever update. Pin the version explicitly to a release tag
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v5
uses: actions/checkout@v6
with:
fetch-depth: 0

Expand All @@ -26,7 +26,7 @@ jobs:
go-version: "stable"

- name: Run GoReleaser
uses: goreleaser/goreleaser-action@v6.4.0
uses: goreleaser/goreleaser-action@v7.0.0
with:
distribution: goreleaser
version: latest
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/update.yml
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v6
with:
ref: dev

Expand All @@ -28,7 +28,7 @@ jobs:
go mod tidy

- name: Commit and push changes
uses: stefanzweifel/git-auto-commit-action@v5
uses: stefanzweifel/git-auto-commit-action@v7
with:
commit_message: "chore: update dependencies [automated]"
branch: dev
20 changes: 14 additions & 6 deletions .github/workflows/vhs.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@ on:
push:
paths:
- vhs/**.tape
schedule:
# every week
- cron: "0 0 * * 0"
workflow_dispatch:

permissions:
contents: write
Expand All @@ -11,7 +15,7 @@ jobs:
vhs:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: actions/checkout@v6

- name: Set up Go
uses: actions/setup-go@v6
Expand All @@ -29,19 +33,23 @@ jobs:
- name: Build linux
run: task linux

- name: Install deps
- name: Install vhs deps
run: |
sudo apt update
sudo apt install -y ffmpeg ttyd

- uses: charmbracelet/vhs-action@v2
with:
path: "vhs/gobuster_dir.tape"
- name: Install vhs
run: |
go install github.com/charmbracelet/vhs@latest

- name: Generate vhs gif
run: |
vhs vhs/gobuster_dir.tape -o vhs/gobuster_dir.gif

- name: commit and push changes
run: |
git config user.name "Github"
git config user.email "<>"
git add vhs/*.gif
git commit -m "update vhs gifs" || echo "no changes to commit"
git push origin master
git push
2 changes: 1 addition & 1 deletion .github/workflows/yamllint.yml
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ jobs:
name: yamllint
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v5
- uses: actions/checkout@v6
- uses: karancode/yamllint-github-action@master
with:
# fail on warnings and errors
Expand Down
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -30,3 +30,4 @@ config.json
gobuster
*.txt
dist/
wordlist
19 changes: 19 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,13 @@ gobuster dir -u https://example.com -w wordlist.txt -l

# Filter by status codes
gobuster dir -u https://example.com -w wordlist.txt -s 200,301,302

# Filter using a regex against the response body
# This can be handy for websites that return status code 200 for everything, but the html contains an error message
gobuster dir -u https://example.com -w wordlist.txt -re "error\shello"

# Filter using a regex but inverted against the response body
gobuster dir -u https://example.com -w wordlist.txt -rei "(?i)\berror\b"
```

#### 🔍 DNS Mode (`dns`)
Expand Down Expand Up @@ -344,6 +351,18 @@ _Remember: Always test responsibly and with proper authorization._

<details>

<summary>3.8.3</summary>

## 3.8.3

- Add option to filter body by regex
- Add option to save response bodies
- Allow comma in Header values passed via the CLI

</details>

<details>

<summary>3.8.2</summary>

## 3.8.2
Expand Down
31 changes: 27 additions & 4 deletions cli/dir/dir.go
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@ package dir
import (
"errors"
"fmt"
"regexp"

internalcli "github.com/OJ/gobuster/v3/cli"
"github.com/OJ/gobuster/v3/gobusterdir"
Expand Down Expand Up @@ -36,11 +37,19 @@ func getFlags() []cli.Flag {
&cli.BoolFlag{Name: "discover-backup", Aliases: []string{"db"}, Value: false, Usage: "Upon finding a file search for backup files by appending multiple backup extensions"},
&cli.StringFlag{Name: "exclude-length", Aliases: []string{"xl"}, Usage: "exclude the following content lengths (completely ignores the status). You can separate multiple lengths by comma and it also supports ranges like 203-206"},
&cli.BoolFlag{Name: "force", Value: false, Usage: "Continue even if the prechecks fail. Please only use this if you know what you are doing, it can lead to unexpected results."},
&cli.StringFlag{Name: "regex", Aliases: []string{"re"}, Usage: "Use regex to filter the results, by inspecting the content of the response body. When using this option be sure to set the status-codes and status-codes-blacklist options accordingly. The regex check is done after the status code checks. Only responses matching the regex will be displayed."},
&cli.StringFlag{Name: "regex-invert", Aliases: []string{"rei"}, Usage: "Use regex to filter the results, but inverted, by inspecting the content of the response body. When using this option be sure to set the status-codes and status-codes-blacklist options accordingly. The regex check is done after the status code checks. Only responses NOT matching the regex will be displayed."},
}...)
return flags
}

func run(c *cli.Context) error {
globalOpts, err := internalcli.ParseGlobalOptions(c)
if err != nil {
return err
}
log := libgobuster.NewLogger(globalOpts.Debug)

pluginOpts := gobusterdir.NewOptions()

httpOptions, err := internalcli.ParseCommonHTTPOptions(c)
Expand Down Expand Up @@ -101,12 +110,26 @@ func run(c *cli.Context) error {
}
pluginOpts.ExcludeLengthParsed = ret4

globalOpts, err := internalcli.ParseGlobalOptions(c)
if err != nil {
return err
if c.IsSet("regex") && c.IsSet("regex-invert") {
return errors.New("regex and regex-invert are mutually exclusive, please set only one")
}

log := libgobuster.NewLogger(globalOpts.Debug)
if c.IsSet("regex") && c.String("regex") != "" {
regex, err := regexp.Compile(c.String("regex"))
if err != nil {
return fmt.Errorf("invalid value for regex: %w", err)
}
pluginOpts.Regex = regex
}

if c.IsSet("regex-invert") && c.String("regex-invert") != "" {
regex, err := regexp.Compile(c.String("regex-invert"))
if err != nil {
return fmt.Errorf("invalid value for regex-invert: %w", err)
}
pluginOpts.Regex = regex
pluginOpts.RegexInvert = true
}

plugin, err := gobusterdir.New(&globalOpts, pluginOpts, log)
if err != nil {
Expand Down
11 changes: 10 additions & 1 deletion cli/options.go
Original file line number Diff line number Diff line change
Expand Up @@ -129,7 +129,8 @@ func CommonHTTPOptions() []cli.Flag {
&cli.BoolFlag{Name: "follow-redirect", Aliases: []string{"r"}, Value: false, Usage: "Follow redirects"},
&cli.StringSliceFlag{Name: "headers", Aliases: []string{"H"}, Usage: "Specify HTTP headers, -H 'Header1: val1' -H 'Header2: val2'"},
&cli.BoolFlag{Name: "no-canonicalize-headers", Aliases: []string{"nch"}, Value: false, Usage: "Do not canonicalize HTTP header names. If set header names are sent as is"},
&cli.StringFlag{Name: "method", Aliases: []string{"m"}, Value: "GET", Usage: "the password to the p12 file"},
&cli.StringFlag{Name: "method", Aliases: []string{"m"}, Value: "GET", Usage: "Specify HTTP method"},
&cli.StringFlag{Name: "body-output-dir", Usage: "Directory to store response bodies"},
}...)
flags = append(flags, BasicHTTPOptions()...)
return flags
Expand Down Expand Up @@ -209,6 +210,14 @@ func ParseCommonHTTPOptions(c *cli.Context) (libgobuster.HTTPOptions, error) {
opts.Headers = append(opts.Headers, header)
}

if c.IsSet("body-output-dir") {
opts.BodyOutputDir = c.String("body-output-dir")
err = os.MkdirAll(opts.BodyOutputDir, 0o755)
if err != nil {
return opts, fmt.Errorf("could not create body output dir %q: %w", opts.BodyOutputDir, err)
}
}

return opts, nil
}

Expand Down
24 changes: 12 additions & 12 deletions go.mod
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
module github.com/OJ/gobuster/v3

go 1.25
go 1.25.0

require (
github.com/fatih/color v1.18.0
github.com/fatih/color v1.19.0
github.com/google/uuid v1.6.0
github.com/pin/tftp/v3 v3.1.0
github.com/pin/tftp/v3 v3.2.0
github.com/urfave/cli/v2 v2.27.7
go.uber.org/automaxprocs v1.6.0
golang.org/x/term v0.37.0
software.sslmate.com/src/go-pkcs12 v0.6.0
golang.org/x/term v0.41.0
software.sslmate.com/src/go-pkcs12 v0.7.0
)

require (
Expand All @@ -19,13 +19,13 @@ require (
github.com/mattn/go-isatty v0.0.20 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/xrash/smetrics v0.0.0-20250705151800-55b8f293f342 // indirect
golang.org/x/crypto v0.45.0 // indirect
golang.org/x/mod v0.27.0 // indirect
golang.org/x/net v0.47.0 // indirect
golang.org/x/sync v0.16.0 // indirect
golang.org/x/sys v0.38.0 // indirect
golang.org/x/tools v0.36.0 // indirect
mvdan.cc/gofumpt v0.9.0 // indirect
golang.org/x/crypto v0.49.0 // indirect
golang.org/x/mod v0.33.0 // indirect
golang.org/x/net v0.52.0 // indirect
golang.org/x/sync v0.19.0 // indirect
golang.org/x/sys v0.42.0 // indirect
golang.org/x/tools v0.42.0 // indirect
mvdan.cc/gofumpt v0.9.2 // indirect
)

tool mvdan.cc/gofumpt
Loading
Loading