Gobuster

Import the plain-text output file written by gobuster’s dir mode, which brute-forces paths against a web server and prints one line per path that exists.

File Types#

Plain text, as written by gobuster dir -o. gobuster has no JSON output for dir mode, so the printed line is the interface:

robots.txt           (Status: 200) [Size: 49]
admin                (Status: 301) [Size: 169] [--> http://target.example.com/admin/]

Run gobuster with -q so the banner and progress footer stay out of the file. If they are present they are skipped rather than imported.

gobuster dir -u https://target.example.com -w wordlist.txt -q -o gobuster.txt

Every finding is reported at severity Info. gobuster reports paths that exist, not paths that are wrong; whether a discovered path matters depends on which path it is, which is a judgement about the application rather than something gobuster measures.

Two limitations are worth knowing before you import:

• The scanned host is not in the file. gobuster’s hit lines carry the path only, so an endpoint is attached only when a hit redirects to an absolute URL. Each finding says so in its description rather than inventing a host.
• Only dir mode is parsed. gobuster’s dns and vhost modes write Found: name — subdomain and virtual-host inventory rather than a weakness — and those lines are not imported.

Sample Scan Data#

Sample Gobuster scans can be found here.

Default Deduplication Hashcode Fields#

By default, DefectDojo identifies duplicate findings using these hashcode fields:

• title
• endpoints

The description is deliberately left out: it records what the scan saw at the time (a response size, a detected version, a timestamp, a payload) and that changes between two scans of an unchanged target, which would import the same finding again on every rescan.