DOCSEARCHbyAlgolia
Submit Docs

feroxbuster Documentation

website·Indexed 30 days ago

https://epi052.github.io/feroxbuster-docs/

Documentation for feroxbuster, a tool for directory and file discovery. Includes installation guides for Kali Linux, Docker, AUR, and winget, as well as configuration details for ferox-config.toml, CLI usage, and examples for filtering responses by status, size, or regex, rate limiting, and managing SSL certificates.

Tokens
12.9K
Snippets
99
Records
117
Agent score
72%

What's inside feroxbuster

  1. Perform forced browsing with feroxbuster

    feroxbuster is a tool used for Forced Browsing (also known as Predictable Resource Location, File Enumeration, Directory Enumeration, or Resource Enumeration). It uses brute force combined with a wordlist to discover unlinked content in target directories that may contain sensitive information such as source code, credentials, or internal network addressing.

  2. Detect directory listings with feroxbuster

    feroxbuster can automatically detect when a server has directory listing enabled. Depending on the configuration, it will either simply report the discovery or report it and then scan the extracted links.

    Detection Methods:

    1. Standard Detection (v2.5.0+): Analyzes page titles for common patterns:
      • Apache/Python/Tomcat: Index of / or Directory Listing for /
      • ASP.NET: Directory Listing -- /
    2. Enhanced Heuristic Detection (v2.13.1+): Used for custom or non-standard listings. A page is classified as a directory listing if at least 2 of the following 4 signals are present:
      • Parent Directory Links: Links with href="../", href="..", or text like "parent directory", "to parent", or "up to parent".
      • Directory Table Headers: Headers such as "File Name", "Filename", "Name", "Size", "File Size", "Date", "Last Modified", "Modified", or "Last Mod".
      • Sorting Query Parameters: Links containing ?C=N (name), ?C=S (size), ?C=M (modified), or ?C=D (date).
      • High Link Density: Three or more links pointing to files or directories.

  3. Install feroxbuster on Windows x86_64

    Download and install feroxbuster for 64-bit Windows using PowerShell. This involves downloading the zip archive, extracting it, and running the executable to verify the version.
    Invoke-WebRequest https://github.com/epi052/feroxbuster/releases/latest/download/x86_64-windows-feroxbuster.exe.zip -OutFile feroxbuster.zip
Expand-Archive .\eroxbuster.zip
.\feroxbuster\feroxbuster.exe -V

  4. Use --force-recursion to override default recursion logic

    By default, feroxbuster only recurses into endpoints if they end with a /, return a 200-299/403 status code, or return a 300-399 status with a Location header that appends a trailing slash.

    Some web servers strip trailing slashes (e.g., redirecting http://localhost/assets/ to http://localhost/assets), which prevents the default logic from recursing. The --force-recursion flag tells feroxbuster to ignore these rules and recurse into any 'found' asset (any endpoint not filtered out by settings like --filter-status).

    feroxbuster <url> --force-recursion

  5. Discover backup files using --collect-backups

    The --collect-backups flag instructs feroxbuster to send additional queries for every file found during a scan to check for common backup extensions. By default, it checks for ~, .bak, .bak2, .old, .1, and .swp.

    When a file like index.php is found, feroxbuster will attempt to find:

    • Appended extensions: index.php~, index.php.bak, index.php.bak2, index.php.old, index.php.1
    • Replaced extensions: index.bak
    • Vim swap files: .index.php.swp (prefix . and append .swp)

    Since version 2.10.2, you can specify a custom list of extensions to query instead of the defaults by passing them as arguments after the flag.

    # Use default backup extensions
feroxbuster -u https://some-example-site.com --collect-backups

# Use a custom list of backup extensions
feroxbuster -u https://some-example-site.com --collect-backups .bak .save .save~

  6. Filter responses by line and word count in feroxbuster

    Feroxbuster allows you to filter out responses based on the number of lines or words contained within the response body. This is useful for removing repetitive pages or boilerplate content from scan results. You can specify multiple values to filter out several different counts at once.
    # Filter out responses with exactly 20 lines and responses with 30 or 31 lines
feroxbuster -N 20 -N 31,30 <url>

# Filter out responses with exactly 312 words and responses with 82 or 91 words
feroxbuster -W 312 -W 91,82 <url>

  7. Filter responses by similarity to a specific page using --filter-similar-to

    Use the --filter-similar-to flag to ignore responses that are nearly identical to a provided example URL. This is particularly useful for filtering out pages that change slightly on every request (e.g., pages with dynamic CSRF tokens) where standard line, word, or character filters are ineffective.

    Feroxbuster fetches the specified example page, generates a hash of the response body using the Simhash algorithm, and compares subsequent pages against this hash. If the Hamming distance between the hashes is 3 or less, the page is considered similar and is filtered out.

    ./feroxbuster -u https://somesite.xyz --filter-similar-to https://somesite.xyz/register

  8. Route feroxbuster traffic through a proxy

    Use the --proxy flag to route traffic through a proxy. This is useful for intercepting traffic with tools like Burp Suite or routing through a SOCKS proxy (using socks5h for DNS lookups).
    # Proxy through Burp Suite
./feroxbuster -u http://127.1 --insecure --proxy http://127.0.0.1:8080

# Proxy through SOCKS5 (including DNS lookups)
./feroxbuster -u http://127.1 --proxy socks5h://127.0.0.1:9050

  9. Generate wordlists from page content using --collect-words

    The --collect-words flag enables feroxbuster to parse the HTML of every valid response and extract words considered 'important' using a Natural Language Processing (NLP) model. These extracted words are then added to the wordlist and requested as endpoints on the target site.
    feroxbuster -u https://some-example-site.com --collect-words

  10. Extract links from detected directory listings

    When feroxbuster detects a directory listing, its behavior depends on the --extract-links flag:

    • Without --extract-links: The directory listing is reported in the output, but no further action is taken.
    • With --extract-links: Every link found within the directory listing response is extracted and automatically requested/scanned.
    # Report directory listings only
feroxbuster -u https://some-example-site.com

# Report and automatically scan all links found in directory listings
feroxbuster -u https://some-example-site.com --extract-links

  11. Dynamically discover extensions using --collect-extensions

    The --collect-extensions flag tells feroxbuster to treat any extension found on a discovered URL as a valid extension to try for all future requests in the current scan. This effectively adds the discovered extension to the internal state as if it were passed via the --extensions (-x) flag.

    Caveats:

    • This is most useful when combined with --extract-links.
    • It may significantly increase the number of requests generated.
    • There is a default list of ignored extensions. If --dont-collect is used, the default ignore list is bypassed and only the values passed to --dont-collect are used.
    feroxbuster -u https://some-example-site.com --collect-extensions

  12. Include custom HTTP headers in requests

    Use the -H flag to include custom headers in the requests sent by feroxbuster. If a header contains a comma, it cannot be passed via the CLI and must be configured in the ferox-config.toml file.
    ./feroxbuster -u http://127.1 -H Accept:application/json "Authorization: Bearer {token}"