Which tool is MOST likely used to find subdomains and their respective directories during an engagement?

• A. Gobuster
• B. Burp Suite
• C. Nessus
• D. Metasploit

Answer: (A)

Enumerating subdomains and their directories relies on rapid web content discovery using wordlists. Gobuster is built for exactly that: it can brute-force DNS to uncover subdomains (dns mode) and brute-force URL paths to find directories and files (dir mode), giving you a map of the site's surface and its subdomains. It’s fast, scriptable, and supports custom wordlists, which makes it ideal for engagements where you need to quickly identify all reachable hosts and their structure. Burp Suite is powerful for manual testing and content discovery within a found site, but it’s more of an interactive testing framework than a focused discovery tool for breadth. Nessus focuses on vulnerability assessment rather than enumerating subdomains or directory structures. Metasploit centers on exploitation, not discovery of where content lives. Therefore Gobuster is the best choice.