> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/web-discovery/feroxbuster.md).

# Feroxbuster

`feroxbuster` is a tool designed to perform [Forced Browsing](https://owasp.org/www-community/attacks/Forced_browsing).

Forced browsing is an attack where the aim is to enumerate and access resources that are not referenced by the web application, but are still accessible by an attacker.

`feroxbuster` uses brute force combined with a wordlist to search for unlinked content in target directories. These resources may store sensitive information about web applications and operational systems, such as source code, credentials, internal network addressing, etc...

This attack is also known as Predictable Resource Location, File Enumeration, Directory Enumeration, and Resource Enumeration.

## Standard scan

Standard scan without recursion (`-n`)

```bash
feroxbuster -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -n -C 404 -x html,php,txt -u http://$TARGET_IP
```

Standard scan **with** recursion (which is the default)

```bash
feroxbuster -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -C 404 -x html,php,txt -u http://$TARGET_IP
```

## Usage information

<details>

<summary>feroxbuster -h</summary>

```
┌──(kali㉿kali)-[~]
└─$ feroxbuster -h
A fast, simple, recursive content discovery tool.

Usage: feroxbuster [OPTIONS]

Options:
  -h, --help     Print help (see more with '--help')
  -V, --version  Print version

Target selection:
  -u, --url <URL>                 The target URL (required, unless [--stdin || --resume-from] used)
      --stdin                     Read url(s) from STDIN
      --resume-from <STATE_FILE>  State file from which to resume a partially complete scan (ex. --resume-from ferox-1606586780.state)

Composite settings:
      --burp         Set --proxy to http://127.0.0.1:8080 and set --insecure to true
      --burp-replay  Set --replay-proxy to http://127.0.0.1:8080 and set --insecure to true
      --smart        Set --auto-tune, --collect-words, and --collect-backups to true
      --thorough     Use the same settings as --smart and set --collect-extensions to true

Proxy settings:
  -p, --proxy <PROXY>                  Proxy to use for requests (ex: http(s)://host:port, socks5(h)://host:port)
  -P, --replay-proxy <REPLAY_PROXY>    Send only unfiltered requests through a Replay Proxy, instead of all requests
  -R, --replay-codes <REPLAY_CODE>...  Status Codes to send through a Replay Proxy when found (default: --status-codes value)

Request settings:
  -a, --user-agent <USER_AGENT>         Sets the User-Agent (default: feroxbuster/2.10.4)
  -A, --random-agent                    Use a random User-Agent
  -x, --extensions <FILE_EXTENSION>...  File extension(s) to search for (ex: -x php -x pdf js); reads values (newline-separated) from file if input starts with an @ (ex: @ext.txt)
  -m, --methods <HTTP_METHODS>...       Which HTTP request method(s) should be sent (default: GET)
      --data <DATA>                     Request's Body; can read data from a file if input starts with an @ (ex: @post.bin)
  -H, --headers <HEADER>...             Specify HTTP headers to be used in each request (ex: -H Header:val -H 'stuff: things')
  -b, --cookies <COOKIE>...             Specify HTTP cookies to be used in each request (ex: -b stuff=things)
  -Q, --query <QUERY>...                Request's URL query parameters (ex: -Q token=stuff -Q secret=key)
  -f, --add-slash                       Append / to each request's URL

Request filters:
      --dont-scan <URL>...  URL(s) or Regex Pattern(s) to exclude from recursion/scans

Response filters:
  -S, --filter-size <SIZE>...                 Filter out messages of a particular size (ex: -S 5120 -S 4927,1970)
  -X, --filter-regex <REGEX>...               Filter out messages via regular expression matching on the response's body/headers (ex: -X '^ignore me$')
  -W, --filter-words <WORDS>...               Filter out messages of a particular word count (ex: -W 312 -W 91,82)
  -N, --filter-lines <LINES>...               Filter out messages of a particular line count (ex: -N 20 -N 31,30)
  -C, --filter-status <STATUS_CODE>...        Filter out status codes (deny list) (ex: -C 200 -C 401)
      --filter-similar-to <UNWANTED_PAGE>...  Filter out pages that are similar to the given page (ex. --filter-similar-to http://site.xyz/soft404)
  -s, --status-codes <STATUS_CODE>...         Status Codes to include (allow list) (default: All Status Codes)

Client settings:
  -T, --timeout <SECONDS>          Number of seconds before a client's request times out (default: 7)
  -r, --redirects                  Allow client to follow redirects
  -k, --insecure                   Disables TLS certificate validation in the client
      --server-certs <PEM|DER>...  Add custom root certificate(s) for servers with unknown certificates
      --client-cert <PEM>          Add a PEM encoded certificate for mutual authentication (mTLS)
      --client-key <PEM>           Add a PEM encoded private key for mutual authentication (mTLS)

Scan settings:
  -t, --threads <THREADS>          Number of concurrent threads (default: 50)
  -n, --no-recursion               Do not scan recursively
  -d, --depth <RECURSION_DEPTH>    Maximum recursion depth, a depth of 0 is infinite recursion (default: 4)
      --force-recursion            Force recursion attempts on all 'found' endpoints (still respects recursion depth)
      --dont-extract-links         Don't extract links from response body (html, javascript, etc...)
  -L, --scan-limit <SCAN_LIMIT>    Limit total number of concurrent scans (default: 0, i.e. no limit)
      --parallel <PARALLEL_SCANS>  Run parallel feroxbuster instances (one child process per url passed via stdin)
      --rate-limit <RATE_LIMIT>    Limit number of requests per second (per directory) (default: 0, i.e. no limit)
      --time-limit <TIME_SPEC>     Limit total run time of all scans (ex: --time-limit 10m)
  -w, --wordlist <FILE>            Path or URL of the wordlist
      --auto-tune                  Automatically lower scan rate when an excessive amount of errors are encountered
      --auto-bail                  Automatically stop scanning when an excessive amount of errors are encountered
  -D, --dont-filter                Don't auto-filter wildcard responses

Dynamic collection settings:
  -E, --collect-extensions                      Automatically discover extensions and add them to --extensions (unless they're in --dont-collect)
  -B, --collect-backups [<collect_backups>...]  Automatically request likely backup extensions for "found" urls (default: ~, .bak, .bak2, .old, .1)
  -g, --collect-words                           Automatically discover important words from within responses and add them to the wordlist
  -I, --dont-collect <FILE_EXTENSION>...        File extension(s) to Ignore while collecting extensions (only used with --collect-extensions)

Output settings:
  -v, --verbosity...      Increase verbosity level (use -vv or more for greater effect. [CAUTION] 4 -v's is probably too much)
      --silent            Only print URLs (or JSON w/ --json) + turn off logging (good for piping a list of urls to other commands)
  -q, --quiet             Hide progress bars and banner (good for tmux windows w/ notifications)
      --json              Emit JSON logs to --output and --debug-log instead of normal text
  -o, --output <FILE>     Output file to write results to (use w/ --json for JSON entries)
      --debug-log <FILE>  Output file to write log entries (use w/ --json for JSON entries)
      --no-state          Disable state output file (*.state)

Update settings:
  -U, --update  Update feroxbuster to the latest version

```

</details>

## Resources

feroxbuster - Documentation: <https://epi052.github.io/feroxbuster-docs/docs/>

feroxbuster - Github: <https://github.com/epi052/feroxbuster>

feroxbuster - Kali Tools: <https://www.kali.org/tools/feroxbuster/>