retour aux outils back to tools Ducklings

Feroxbuster

Outil de découverte de contenu rapide et récursif écrit en Rust. Gère les redirections et la récursion automatiquement avec des filtres configurables. Fast, recursive content discovery tool written in Rust. Handles redirects and recursion automatically with configurable filters.

↗ https://github.com/epi052/feroxbuster

Overview

Feroxbuster is a fast, recursive web content discovery tool. Its key advantage over dirb/gobuster is automatic recursion — when it finds a directory, it automatically enumerates it without extra configuration.

Common Usage

Basic scan

feroxbuster -u https://target.com -w /usr/share/wordlists/dirb/common.txt

With file extensions

feroxbuster -u https://target.com -w common.txt -x php,txt,html,bak

Recursive (default behaviour — set max depth)

feroxbuster -u https://target.com -w common.txt -d 3

Filter by status code

feroxbuster -u https://target.com -w common.txt -s 200,301,302

Filter by response size (remove false positives)

feroxbuster -u https://target.com -w common.txt --filter-size 1234

Multiple wordlists

feroxbuster -u https://target.com -w list1.txt -w list2.txt

Custom headers (authentication)

feroxbuster -u https://target.com -w common.txt -H "Cookie: session=abc123"

Rate limiting (polite scanning)

feroxbuster -u https://target.com -w common.txt --rate-limit 100
  • /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
  • /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
  • /usr/share/seclists/Discovery/Web-Content/common.txt
Help / Man page 
feroxbuster [OPTIONS] --url <URL>

TARGET:
  -u, --url URL           Target URL
  -U, --url-file FILE     File of target URLs

WORDLIST:
  -w, --wordlist FILE     Wordlist (repeatable)

FILTERS:
  -s, --status-codes CODE Status codes to include (default: 200-399)
  --filter-status CODE    Status codes to exclude
  --filter-size N         Exclude responses of size N
  --filter-words N        Exclude responses with N words
  --filter-lines N        Exclude responses with N lines
  --filter-regex REGEX    Exclude matching responses

RECURSION:
  -d, --depth N           Max recursion depth (default: 4)
  --no-recursion          Disable recursion

EXTENSIONS:
  -x, --extensions EXT    File extensions to fuzz (php,txt,...)

PERFORMANCE:
  -t, --threads N         Threads (default: 50)
  --rate-limit N          Max requests per second
  --timeout N             Request timeout (default: 7)

OUTPUT:
  -o, --output FILE       Save results to file
  -q, --quiet             Only print found URLs

HTTP:
  -H, --headers KEY:VAL   Custom headers
  -b, --cookies COOKIE    Cookies
  -k                      Disable TLS verification
  --proxy URL             HTTP proxy

Vue d’ensemble

Feroxbuster est un outil de découverte de contenu web rapide et récursif. Son avantage clé sur dirb/gobuster est la récursion automatique : quand il trouve un répertoire, il l’énumère automatiquement sans configuration supplémentaire.

Utilisation courante

# Scan de base
feroxbuster -u https://target.com -w /usr/share/wordlists/dirb/common.txt

# Avec extensions de fichiers
feroxbuster -u https://target.com -w common.txt -x php,txt,html,bak

# Récursif (comportement par défaut : définir la profondeur max)
feroxbuster -u https://target.com -w common.txt -d 3

# Filtrer par code de statut
feroxbuster -u https://target.com -w common.txt -s 200,301,302

# Filtrer par taille de réponse (supprimer les faux positifs)
feroxbuster -u https://target.com -w common.txt --filter-size 1234

# Listes de mots multiples
feroxbuster -u https://target.com -w list1.txt -w list2.txt

# En-têtes personnalisés (authentification)
feroxbuster -u https://target.com -w common.txt -H "Cookie: session=abc123"

# Limitation de débit (scan respectueux)
feroxbuster -u https://target.com -w common.txt --rate-limit 100

Listes de mots recommandées

  • /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
  • /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
  • /usr/share/seclists/Discovery/Web-Content/common.txt
Aide / Page de manuel 
feroxbuster [OPTIONS] --url <URL>

TARGET:
  -u, --url URL           Target URL
  -U, --url-file FILE     File of target URLs

WORDLIST:
  -w, --wordlist FILE     Wordlist (repeatable)

FILTERS:
  -s, --status-codes CODE Status codes to include (default: 200-399)
  --filter-status CODE    Status codes to exclude
  --filter-size N         Exclude responses of size N
  --filter-words N        Exclude responses with N words
  --filter-lines N        Exclude responses with N lines
  --filter-regex REGEX    Exclude matching responses

RECURSION:
  -d, --depth N           Max recursion depth (default: 4)
  --no-recursion          Disable recursion

EXTENSIONS:
  -x, --extensions EXT    File extensions to fuzz (php,txt,...)

PERFORMANCE:
  -t, --threads N         Threads (default: 50)
  --rate-limit N          Max requests per second
  --timeout N             Request timeout (default: 7)

OUTPUT:
  -o, --output FILE       Save results to file
  -q, --quiet             Only print found URLs

HTTP:
  -H, --headers KEY:VAL   Custom headers
  -b, --cookies COOKIE    Cookies
  -k                      Disable TLS verification
  --proxy URL             HTTP proxy