Gobuster

Some options:

-t [no.of threads]
-o [output_file]
-w [wordlist]

Directory and File Enumeration

dir mode
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php, txt, html, js -u http://[MACHINE_IP]

Flag	Description	Example
-c	Set cookie, such as a session ID.
-x	file extensions to scan for.	-x .php, .js, .txt, .html
-H	Set header to pass along.
-k	Skips checking of certificate when https is used. Use case: self-signed certificates	-
-n	don’t want to see status codes of each response received.
-P	Set password to execute authenticated requests.
-U	Set username to execute authenticated requests.
-s	Status code you want to display eg: 200 or a range 300-400
-b	Status codes you don’t want to display. Overrides the -s flag.
--xl	Excludes specific length of the response body.
-r	to follow the redirect that it received as a response to the sent request.	-

Subdomain Enumeration

dns mode
gobuster dns -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt --domain [example.thm]

Flag	Description	Example
--domain	Domain you want to enumerate.	--domain example.thm
-i	Ṣhows IP addresses that the domain and subdomains resolve to.	-
-r	Custom DNS server to use for resolving.
-c	Show CNAME Records (cannot be used with the -i flag).	-

Vhost Enumeration

Virtual hosts are different websites on the same machine. They look like subdomains but virtual hosts are IP-based and are running on the same server.
vhost mode
gobuster vhost -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain -u http://[MACHINE_IP] --domain example.thm

Flag	Description	Example
-u	Base URL (target domain).	-u 10.10.10.10
--append-domain	Appends the base domain to each word in the wordlist (e.g., word.example.com).	-
-m	Specifies the HTTP method (e.g., GET, POST).
--domain	Appends a domain to each wordlist entry to form a valid hostname.	--domain example.thm
--xl	Excludes specific length of the response body.
--xs	Exclude specific status codes
-r	Follows HTTP redirects.

if dns architecture is not configured properly then -u must have IP and --domain and --append-domain flags must be used
else: -u can have the domain name directly, rather than the IP