Gobuster: a DNS found-line is not an HTTP status

The mode chooses the columns

Gobuster’s DNS mode prints names the resolver answered, often with an address in brackets. That line has no HTTP status, because no web request was the thing being reported. Vhost mode prints a name with an HTTP status and a size, because it requested that Host header.

A line that says Found is not one format. The words after Found depend on the mode. If the note does not say the mode, a reader can treat an address as a status or a status as a resolution.

Do not merge the two files

A name can appear in both outputs and mean two facts: it resolved, and a server answered for that Host header. Those are two lines. Write both, each with its mode. Do not collapse them into “Found 200” when the DNS line never had a status.

If a DNS line has an address and you did not run vhost mode, you do not have an HTTP status for that name. Say the status was not requested.

What to file

File the mode, the name, and either the address or the status and size, matching the line. File the resolver for DNS mode or the URL you targeted for vhost mode. Do not invent the column the mode does not print.

Worked case: an address read as HTTP 200

DNS mode prints Found: files.hackblue-lab.org [203.0.113.50]. No vhost run was done. A draft says the name returned HTTP 200 because Found looks like a hit. The brackets hold an address, not a status code.

The note says DNS mode, the name, and the address. HTTP status was not requested. The draft’s 200 is removed. A later vhost line, if one is produced, will be filed separately with its status and size.

mode: dns
name: files.hackblue-lab.org
address: 203.0.113.50
http status: not in this line
vhost run: not done
not: HTTP 200