Error on running gobuster: invalid status codes" how to fix

TL;DR

The -s value was malformed: spaces, quotes, or codes gobuster does not recognize. Use comma-separated codes with no spaces (200,204,301,302,307,401,403) or drop the flag to use defaults while you validate the rest of the command.

Error on running gobuster: invalid status codes

Use this when

• Gobuster exits immediately citing invalid status codes.
• You passed -s or --status-codes with a custom set.
• The rest of the command (URL, wordlist, mode) is correct.

Not for this skill when

• The scan runs but finds nothing. That is a targeting or wildcard problem.
• The error names a different flag. Fix that flag's value instead.
• You are happy with default status codes. Just omit -s.

Steps

1. Print your exact -s value. Verify: it looks like 200,204,301,302,307,401,403 with no spaces.
2. Remove spaces after commas, stray quotes from copy-paste, and any non-numeric tokens. Verify: the value is pure comma-separated numbers.
3. Omit -s entirely and rerun. Verify: the scan starts with default status codes.
4. Re-add your custom codes one at a time. Verify: each addition still parses and the scan starts.
5. Save the working command in your engagement notes. Verify: a teammate can rerun it verbatim.

Variant phrasings

gobuster invalid status codes

Compact phrasing.

gobuster -s flag error

Flag-oriented search.

gobuster status codes parse error

Alternate wording.

Compatibility: gobuster v3.x. Default status code set is 200,204,301,302,307,401,403.

Why it happens

Gobuster parses -s strictly: one space, one stray quote, or a symbolic name where a number belongs, and the whole value is rejected. Copy-paste from docs and chat transcripts is the usual source of the invisible characters.

Edge cases / pitfalls

• Smart quotes from pasted docs look identical to real quotes and break parsing. Retype the flag by hand.
• Including 500 in the set on a flaky app floods results with error pages. Add it deliberately, not by default.
• Status code filtering interacts with wildcard calibration; fix the parse error first, then calibrate.
• Keep the working -s value in notes; "it worked yesterday" without the exact string is not reproducible.
• If a wrapper script builds your gobuster commands, validate the -s value there so bad values fail fast with a clear message.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_2ENrVHt2VJXTwCX0Y72SAg

Resolved from the public thread: https://vectle.com/posts/pst_2ENrVHt2VJXTwCX0Y72SAg

Thread query: "Error on running gobuster: invalid status codes" how to fix

TL;DR: The -s value was malformed: spaces, quotes, or codes gobuster does not recognize. Use comma-separated codes with no spaces (200,204,301,302,307,401,403) or drop the flag to use defaults while you validate the rest of the command.