feroxbuster

feroxbuster — Fast, simple, recursive content-discovery tool written in Rust (v2.11.x). Author: Ben “epi” Risher (@epi052). Key differentiators over gobuster/dirb: recursion is on by default, it extracts links from response bodies (HTML/JS/robots.txt) and scans them, auto-filters obvious wildcard/404 responses, and offers an interactive scan-management menu while running.

Installation

# Kali / Debian / Ubuntu (repo package)
sudo apt install feroxbuster

# Cargo (Rust toolchain, always latest)
cargo install feroxbuster

# Homebrew (macOS / Linuxbrew)
brew install feroxbuster

# Static binary install script (no root needed, drops ./feroxbuster)
curl -sL https://raw.githubusercontent.com/epi052/feroxbuster/main/install-nix.sh | bash

# Prebuilt release binary (Linux x86_64)
curl -sL https://github.com/epi052/feroxbuster/releases/latest/download/x86_64-linux-feroxbuster.tar.gz \
  | tar -xz && sudo mv feroxbuster /usr/local/bin/

# Docker
docker run --init -it ghcr.io/epi052/feroxbuster:latest \
  -u http://target.com -w /wordlists/common.txt

feroxbuster -h        # concise help
feroxbuster --help    # full help with every flag and default
feroxbuster -V        # version

Quick Start

# The one command you'll run 90% of the time — recursion is automatic
feroxbuster -u http://10.10.10.100 -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

# With extensions and a saved log
feroxbuster -u http://10.10.10.100 \
  -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
  -x php,html,txt -o ferox.txt

Core Flags

HTTP / Request Flags

Status Codes, Matchers & Filters

feroxbuster’s real power is filtering. By default it reports status codes 200-299, 301, 302, 307, 308, 401, 403, 405 and auto-filters wildcard responses. Tune with:

Workflow — kill false positives fast: Run once, spot a repeating bogus size/word/line count in the output, then re-run adding -S <size> / -W <words> / -N <lines>. For soft-404 pages that vary in size, --filter-similar-to http://target/definitely-404-page is the sharpest tool.

Recursion Control

# Deep but controlled: unlimited depth, but only 3 directories scanned at once
feroxbuster -u http://target -w wordlist.txt -d 0 -L 3

# Recurse everywhere, but never into logout or static asset paths
feroxbuster -u http://target -w wordlist.txt --force-recursion -I 'logout' -I '\.(js|css|png|jpg)$'

Link Extraction & Collection

feroxbuster parses response bodies and pulls out more targets automatically:

# "Just find everything" mode — collect extensions, backups, and words as it goes
feroxbuster -u http://target -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
  --collect-extensions --collect-backups --collect-words

Performance & Stealth

# Gentle scan against a rate-limited / WAF'd target
feroxbuster -u http://target -w wordlist.txt --rate-limit 20 --auto-tune --auto-bail

# Aggressive but self-throttling one-liner
feroxbuster -u http://target -w wordlist.txt --thorough --auto-tune

Interactive Scan Menu

While a scan is running, press Enter to open the interactive menu. From there you can:

• List all active recursive scans with their IDs.
• Cancel a runaway scan (e.g. a huge auto-indexed directory) without killing the whole run: type the scan number(s) and confirm.
• Cancelled scans are pruned so the rest of the run continues.

This is the main reason to prefer feroxbuster on messy targets — you prune noisy recursion live instead of restarting.

Practical Examples

# Basic recursive scan with extensions
feroxbuster -u http://10.10.10.100 \
  -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
  -x php,html,txt

# Authenticated scan (session cookie + bearer token)
feroxbuster -u http://10.10.10.100 \
  -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
  -b 'PHPSESSID=abc123def456' -H 'Authorization: Bearer eyJhbGciOi...'

# Over HTTPS with a bad cert, following redirects
feroxbuster -u https://10.10.10.100 -w wordlist.txt -k -r

# Proxy everything through Burp
feroxbuster -u http://10.10.10.100 -w wordlist.txt --burp

# Scan fast, but replay only interesting hits to Burp
feroxbuster -u http://10.10.10.100 -w wordlist.txt -t 100 \
  --replay-proxy http://127.0.0.1:8080 --replay-codes 200,301,302

# Filter out a soft-404 baseline (page is 200 but always ~1274 bytes / 96 words)
feroxbuster -u http://10.10.10.100 -w wordlist.txt -S 1274 -W 96

# Only show 200s and 301s
feroxbuster -u http://10.10.10.100 -w wordlist.txt -s 200,301

# Hide 403/404 noise
feroxbuster -u http://10.10.10.100 -w wordlist.txt -C 403,404

# POST-based content discovery
feroxbuster -u http://10.10.10.100 -w wordlist.txt -m POST --data 'action=FUZZ'

# Multiple targets in one run
feroxbuster -u http://10.10.10.100 -u http://10.10.10.101 -w wordlist.txt

# Pipe a list of live hosts from httpx into a parallel scan
cat live_hosts.txt | feroxbuster --stdin -w wordlist.txt --silent

# Save both a human log and machine-readable JSON
feroxbuster -u http://10.10.10.100 -w wordlist.txt -o ferox.txt
feroxbuster -u http://10.10.10.100 -w wordlist.txt --json -o ferox.json

FUZZ Keyword

feroxbuster substitutes the FUZZ keyword anywhere in the URL, headers, cookies, query, or body — combine with multiple wordlists for positional fuzzing:

# Fuzz a path segment
feroxbuster -u http://10.10.10.100/FUZZ/admin -w wordlist.txt

# Fuzz a query-parameter value
feroxbuster -u 'http://10.10.10.100/item?id=FUZZ' -w /usr/share/seclists/Fuzzing/4-digits-0000-9999.txt

# Fuzz a header value
feroxbuster -u http://10.10.10.100 -H 'X-Forwarded-For: FUZZ' -w ips.txt

Resume & State Files

Every scan writes a ferox-<timestamp>.state file on interruption (Ctrl-C) so nothing is lost:

# Ctrl-C mid-scan writes ferox-1694781234.state, then:
feroxbuster --resume-from ferox-1694781234.state

Config File (ferox-config.toml)

Persistent defaults live in ferox-config.toml, searched in the current directory, then ~/.config/feroxbuster/, then /etc/feroxbuster/. Generate a documented template:

# The repo ships a fully-commented template
curl -sL https://raw.githubusercontent.com/epi052/feroxbuster/main/ferox-config.toml.example \
  -o ~/.config/feroxbuster/ferox-config.toml

# ~/.config/feroxbuster/ferox-config.toml
wordlist = "/usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt"
threads  = 50
depth    = 3
extensions = ["php", "html", "txt", "bak"]
auto_tune  = true
# status codes to hide by default
filter_status = [404]

Recommended Wordlists

Extension Stacking by Tech Stack

Match -x to the detected technology (or let --collect-extensions learn them):

# PHP:       -x php,phps,php5,phtml,inc,bak
# ASP/.NET:  -x asp,aspx,ashx,asmx,config
# Java:      -x jsp,jspx,do,action
# Node/JS:   -x js,json,ts,map
# Python:    -x py,pyc,wsgi
# Backups:   -x bak,old,orig,save,swp,txt,zip,tar.gz   (or just --collect-backups)

Quick Reference — Common Workflows

HTB / CTF Initial Enumeration

# One recursive pass with extensions, collect as you go, gentle auto-tuning
feroxbuster -u http://target.htb \
  -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
  -x php,html,txt -C 404 --collect-extensions --auto-tune -o ferox_initial.txt

Web App Pentest via Burp

# Fast scan, but only matched hits land in Burp's proxy history for triage
feroxbuster -u https://target.com \
  -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt \
  -x php,bak,old,conf -k -t 80 \
  --replay-proxy http://127.0.0.1:8080 --replay-codes 200,301,302,401 \
  -o ferox_pentest.txt

Bug Bounty — many hosts, be polite

subfinder -d target.com -silent | httpx -silent \
  | feroxbuster --stdin -w wordlist.txt --rate-limit 15 --auto-tune --auto-bail --silent -o ferox_bb.txt

Troubleshooting

feroxbuster vs the Alternatives

See Also

• ffuf — when you need multi-position fuzzing and advanced matchers.
• gobuster — when you specifically want DNS/vhost/S3 modes.

Based on feroxbuster v2.11.x — https://github.com/epi052/feroxbuster