feroxbuster

OVERVIEW

feroxbuster is a content-discovery tool written in Rust that brute-forces directories and files with a wordlist, then automatically recurses into any new directory it finds — no need to manually re-launch the scan against each discovered path like with older bash-wrapped fuzzers.

It ships with sane defaults (auto-filtering wildcard responses, following redirects, extracting links from HTML responses) and scales to very large wordlists thanks to its Rust core, while still exposing filters by status code, size, word count, and regex for cutting noise on chatty applications.

USE CASES

Practical use cases

• 01

  Recursively mapping the full directory structure of a web app from a single command.

• 02

  Extracting links from crawled HTML/JS responses to seed further fuzzing.

• 03

  Auto-filtering wildcard/soft-404 responses on apps that return 200 for everything.

• 04

  Running large wordlists against multiple hosts in scope without manual re-launching.

QUICK START

When you need automatic recursive directory brute-forcing without manually re-running the fuzzer on every new folder found.

1. Confirm the target and depth of recursion are inside the agreed scope.
2. Install via cargo, a package manager, or a precompiled release binary.
3. Run a baseline scan against the root URL with a moderate wordlist.
4. Let feroxbuster recurse automatically, watching depth so it doesn't run unbounded on a huge app.
5. Review the extracted links and discovered paths, verifying anything interesting manually.

feroxbuster -u https://target.example.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,html

BEFORE YOU RUN IT

What to check before running it