security enabled community medium v1.0.0

feroxbuster

Fast, recursive content discovery tool written in Rust for directory and file brute-forcing with automatic filtering and Burp integration.

📋 Live Preview

feroxbuster -u {target} -w {wordlist} -x {extensions}

🌍 target → url 🌍 wordlist → /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt 🌍 extensions → php,html,js,txt

feroxbuster -u {target} -w {wordlist} -x {extensions}

Sandbox: execFile · Timeout: 1800s

Capabilities

web.discovery.path

web.discovery.file

web.discovery.recursive

web.content.brute

web.filter.response

Parameters

Name	Type	Required	Default	Description	Aliases
`url`	string	Yes	-	Target URL	`-u`
`wordlist`	file	Yes	-	Path to wordlist file	`-w`
`extensions`	string	No	-	File extensions to scan (comma-separated)	`-x`
`threads`	integer	No	50	Number of concurrent threads	`-t`
`depth`	integer	No	-	Maximum recursion depth	`-d`
`follow-redirect`	boolean	No	-	Follow HTTP redirects	`-r`
`status-codes`	string	No	-	Status codes to include	`-s`
`output`	file	No	-	Output file path	`-o`
`json`	boolean	No	-	Enable JSON output	`--json`
`silent`	boolean	No	-	Silent mode (only output results)	`--silent`
`headers`	string	No	-	Custom HTTP headers	`-H`
`user-agent`	string	No	-	Custom User-Agent string	`-a`
`proxy`	string	No	-	Proxy URL	`-P`
`timeout`	integer	No	-	Request timeout in seconds	`-T`
`verbose`	boolean	No	-	Verbose output	`-v`
`filter-status`	string	No	-	Filter by status codes	`--filter-status`
`filter-size`	string	No	-	Filter by response size	`--filter-size`
`filter-regex`	string	No	-	Filter by regex pattern	`--filter-regex`
`filter-words`	string	No	-	Filter by word count	`--filter-words`
`filter-lines`	string	No	-	Filter by line count	`--filter-lines`
`auto-tune`	boolean	No	-	Automatically tune scan parameters	`--auto-tune`
`filter_lines`	boolean	No	-	Filter by line count	`--filter-lines`
`filter_regex`	boolean	No	-	Filter by regex pattern	`--filter-regex`
`filter_size`	boolean	No	-	Filter by response size	`--filter-size`
`filter_status`	boolean	No	-	Filter by status codes	`--filter-status`
`filter_words`	boolean	No	-	Filter by word count	`--filter-words`
`user_agent`	boolean	No	-	string	`--user-agent`, `-Agent`
`v`	boolean	No	-	Verbose output	`-v`, `--verbose`

Artifacts

Type	Description	MIME	Schema	Trust
`web.discovery.results`	Discovered URLs and directories	application/json	-	community

Contract

Inputs

web.target.url

Target URL

file.wordlist

Wordlist for brute-forcing

web.file.extension

File extensions to discover

Outputs

web.discovery.results

Found paths with status codes

Side effects: network_traffic

Workflow Edges

Produces

web.discovery.results

Consumes

web.target.urlfile.wordlistweb.file.extension

Resource Profile

Resource	Value
CPU	low
Memory	64 MB
Network	medium
Disk I/O	low

Examples

Basic directory scan with extensions

feroxbuster -u https://example.com -w /usr/share/wordlists/dirb/common.txt -x php,html,js -t 50

Recursive scan with depth control

feroxbuster -u https://example.com -w wordlist.txt -d 3 -r -t 30

Scan with proxy (Burp Suite integration)

feroxbuster -u https://example.com -w wordlist.txt -P http://127.0.0.1:8080

JSON output with status code filtering

feroxbuster -u https://example.com -w wordlist.txt --json -o results.json -s 200,204,301

Silent mode with custom headers

feroxbuster -u https://example.com -w wordlist.txt --silent -H "Authorization: Bearer token"

Advanced filtering by response attributes

feroxbuster -u https://example.com -w wordlist.txt --filter-size 0 --filter-status 404,403

Auto-tuning for optimal performance

feroxbuster -u https://example.com -w wordlist.txt --auto-tune

Documentation

Feroxbuster — Fast Content Discovery

Feroxbuster is a fast, recursive content discovery tool written in Rust. It combines speed with advanced features like automatic filtering, Burp Suite integration, and recursive scanning.

Key Features

Recursive Scanning: Automatically crawls discovered directories
Auto-Tuning: Dynamically adjusts scan parameters for speed
Advanced Filtering: Filter by status, size, regex, words, or lines
Burp Replay: Forward results directly to Burp Suite
JSON Output: Structured output for programmatic processing

Basic Usage

# Basic directory scan
feroxbuster -u https://example.com -w wordlist.txt -x php,html

# Recursive scan with auto-tuning
feroxbuster -u https://example.com -w wordlist.txt -d 3 -r --auto-tune

# Proxy integration with JSON output
feroxbuster -u https://example.com -w wordlist.txt -P http://127.0.0.1:8080 --json -o output.json

Operational Security

Use --silent to minimize console output
Auto-tuning adjusts speed to avoid overwhelming targets
Scanning without authorization is illegal

Related Tools

gobusterdirsearchffufwfuzz

References

Feroxbuster GitHub