Gobuster DNS and vhost modes: audit names after a decommission

Three modes, one binary

Gobuster brute-forces names from a wordlist. dir mode tries paths, dns mode tries subdomains against a resolver, and vhost mode sends one IP many Host headers to find virtual hosts the server still answers for. This lesson uses the last two to check a migration, where the question is “did the old names really go away?”.

dns mode against your zone

Build the wordlist from the retired names in the change ticket plus a general list. --resolver points at your authoritative server so caches do not hide a stale answer. Flag names change between releases; v3.6 uses -d for the domain.

gobuster dns -d hackblue-lab.org -w retired-and-common.txt \
  --resolver 198.51.100.53 -t 10 -i

Found: www.hackblue-lab.org [203.0.113.10]
Found: api.hackblue-lab.org [203.0.113.24]
Found: billing-v1.hackblue-lab.org [192.0.2.80]

vhost mode against the old load balancer

A name can be gone from DNS while the old server still serves it. vhost mode sends Host: word.domain to one address. --append-domain builds the full name from each word. Run it against the old balancer’s address before it is released.

gobuster vhost -u https://192.0.2.80 -k --append-domain \
  --domain hackblue-lab.org -w retired-and-common.txt -t 5

Found: billing-v1.hackblue-lab.org Status: 200 [Size: 7422]
Found: reports.hackblue-lab.org Status: 302 [Size: 0] [--> /login]

Worked case: a migration with two leftovers

The change ticket says billing-v1 was retired. dns mode shows it still resolves, because the record lived in a secondary zone the ticket missed. vhost mode shows the old balancer still serves billing-v1 and a reports host that nobody listed.

Both go back into the change: delete the secondary record, remove the virtual hosts, and only then release the address. Adding these two commands to the decommission runbook makes the check repeatable.