feroxbuster

Recursive Web Enumeration Tool - Rust

Installation

Arch

AUR repo

yay -S feroxbuster

Kali

sudo apt get feroxbuster

---

Common Uses

Basic Usage

feroxbuster -u <url> -w <wordlist>

Verbose Output

feroxbuster -u <url> -w <wordlist> -v

Skip TSL+Slash

feroxbuster -u <url> -w <wordlist> -k -f -d 1

Save output to a file

feroxbuster -u <url> -w <wordlist> --output <file.txt>

Look for extensions

feroxbuster -u <url> -w <wordlist> --extensions .txt, .js

---

Scanner Parameters

Number of threads

feroxbuster -u <url> -w <wordlist> -t <number_of_threads>

Maximum amount of active connections per thread

feroxbuster -u <url> -w <wordlist> --scan-limit <number>

Set a timeout

feroxbuster -u <url> -w <wordlist> --rate-limit <number>

• For example, in this case there will be 8 active connections and each connection will have a timeout of 500ms for 1 URL at the time

feroxbuster --threads 4 --scan-limit 2 --rate-limit 2

• On the other the hand, here there will be 8 active connection with a timeout of 500ms for 4 URLs at the time

feroxbuster --threads 2--scan-limit 4 --rate-limit 2

---

Filters

Exclude by status code

feroxbuster -u <url> -w <wordlist> -x 404

Include by status code

feroxbuster -u <url> -w <wordlist> -c 200

Exclude by size request

feroxbuster -u <url> -w <wordlist> -S <size>

Exclude by regex

feroxbuster -u <url> -w <wordlist> -X "Access Denied"

Exclude by words

feroxbuster -u <url> -w <wordlist> -W 0-10

Exclude by lines

feroxbuster -u <url> -w <wordlist> -N 50-

Exclude a directory

feroxbuster -u <url> -w <wordlist> --dont-scan /uploads

Exclude similar pages

feroxbuster -u <url> -w <wordlist> --filter-similar-to error.html

---

Special Options

Recursive Scan

feroxbuster -u http://example.com -w wordlist.txt --depth 3

Disable Recursion

feroxbuster -u http://example.com -w wordlist.txt --no-recursion

Follow redirects automatically

feroxbuster -u http://example.com -w wordlist.txt --url-redirect

Specify the user agent

feroxbuster -u <url> -w <wordlist> -H "User-Agent: <user_agent>"

Provide a User Cookie

feroxbuster -u http://example.com -w /path/to/wordlist.txt -H "Cookie: sessionid=your_session_id"

Follow redirects from 302 responses

feroxbuster -u <url> -w <wordlist> -r

Use SSL verification/Disable TLS validation

feroxbuster -u <url> -w <wordlist> -k

Collect Words

feroxbuster -u <url> -w <wordlist> --collect-words

Extract links

feroxbuster -u <url> -w <wordlist> --extract-links

Collect Backups

feroxbuster -u <url> -w <wordlist> --collect-backups