aeondave/feroxbuster

Feroxbuster

Recursive, fast content discovery — handles JavaScript-rendered apps and auto-recurses into found dirs.

Quick Start

# Basic scan
feroxbuster -u http://example.com -w /usr/share/wordlists/dirb/common.txt

# With extensions
feroxbuster -u http://example.com -w common.txt -x php,html,txt

# No recursion (flat scan)
feroxbuster -u http://example.com -w common.txt --no-recursion

Core Flags

| Flag | Description | |------|-------------| | -u <url> | Target URL | | -w <wordlist> | Wordlist (use - to read stdin) | | -x <ext> | File extensions comma-separated | | -t <n> | Threads (default 50) | | -d <n> | Recursion depth (default 4, 0 = unlimited) | | --no-recursion | Disable recursion | | -s <codes> | Status codes to match (default 200,204,301,302,307,308,401,403,405) | | -C <codes> | Filter/exclude status codes | | -S <size> | Filter by response size | | -W <words> | Filter by word count | | -L <lines> | Filter by line count | | -H <header> | Custom HTTP header | | -b <cookie> | Cookie value | | -k | Disable TLS verification | | -r | Follow redirects | | --proxy <url> | HTTP/SOCKS5 proxy | | -o <file> | Output file | | -q | Quiet (no progress bar) | | --json | JSON output | | --auto-tune | Automatically slow down on errors | | --smart-auto-tune | Only slow on 429/503 | | --collect-words | Collect words from responses for wordlist mutation | | --collect-backups | Also request common backup file extensions | | --collect-extensions | Collect extensions from responses | | --resume-from <state> | Resume from a previous scan state file | | --extract-links | Extract links from HTML and add to queue | | --scan-limit <n> | Max concurrent scans (for recursion) | | --time-limit <dur> | Max time limit (e.g., 10m) | | -A | Random User-Agent per request | | --dont-filter | Disable auto-filter of wildcard responses |

Filtering Examples

# Filter out 404 and 302
feroxbuster -u http://target.com -w common.txt -C 404,302

# Filter by response size (hide 0-byte responses)
feroxbuster -u http://target.com -w common.txt -S 0

# Show only 200 responses
feroxbuster -u http://target.com -w common.txt -s 200

Common Workflows

# Recursive scan with extensions, output to file
feroxbuster -u https://target.com -w raft-medium.txt -x php,bak,conf -o results.txt

# API endpoint discovery (JSON-focused)
feroxbuster -u https://api.target.com -w api-endpoints.txt -x json -H "Accept: application/json"

# Authenticated scan
feroxbuster -u https://target.com -w common.txt -H "Authorization: Bearer TOKEN"

# Behind proxy (Burp)
feroxbuster -u http://target.com -w common.txt --proxy http://127.0.0.1:8080 -k

# Fast aggressive scan
feroxbuster -u http://target.com -w big.txt -t 100 --no-recursion -d 1

# Scan multiple URLs from file
feroxbuster --stdin -w common.txt < urls.txt

# Link extraction (spider + brute)
feroxbuster -u https://target.com -w common.txt --extract-links

# Smart collect mode (mutate wordlist from response)
feroxbuster -u https://target.com -w common.txt --collect-words --collect-extensions

# Time-boxed scan
feroxbuster -u https://target.com -w big.txt --time-limit 5m

# Resume interrupted scan
feroxbuster --resume-from ferox-target-state.json

Config File (~/.config/feroxbuster/ferox-config.toml)

# Set defaults to avoid repeating flags
wordlist = "/usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt"
threads = 50
timeout = 10
status_codes = [200, 204, 301, 302, 307, 401, 403]
filter_status = [404]
auto_tune = true
collect_words = true
extract_links = true
user_agent = "Mozilla/5.0 (compatible; feroxbuster)"

Interactive Controls

While running, press:

• Enter — display current state
• s — stop a specific URL scan
• q / Ctrl+C — quit

Resources

| File | When to load | |------|--------------| | references/filters.md | Detailed filter flag combinations, size/word/line-based noise reduction |