Feroxbuster

Feroxbuster

Purpose

Use this skill for fast recursive content discovery on approved web targets when the methodology supports deeper enumeration than a simple path list.

Phase Fit

• Primary: Discovery and Reconnaissance, Vulnerability Analysis
• Secondary: Retest and Closure

Use When

• Need recursive directory discovery on a confirmed web target.
• Need to explore likely hidden content with controlled depth.
• Need a repeatable CLI workflow for web content retesting.

Avoid When

• Recursion or threading could stress a fragile application.
• Broad content discovery would exceed the agreed impact level.

Inputs

• Confirmed base URL
• Narrow wordlist aligned to the hypothesis
• Recursion depth, thread count, and exclusions

Procedure

1. Start with the shallowest depth and lowest thread count that can answer the question.
2. Separate authenticated and unauthenticated discovery.
3. Review results for real application content rather than noise.
4. Escalate only the most credible paths to manual validation.
5. Save the exact recursion settings for retest.

Command Syntax

Replace sample targets with approved in-scope assets.

# Basic directory scan
feroxbuster -u https://portal.contoso.com -w /usr/share/seclists/Discovery/Web-Content/common.txt -o contoso-ferox.txt

# Recursive scan with depth limit
feroxbuster -u https://portal.contoso.com -w common.txt -d 3 -o contoso-recursive.txt

# Include file extensions
feroxbuster -u https://portal.contoso.com -w common.txt -x php,aspx,html -o contoso-ext.txt

# API subdirectory scan
feroxbuster -u https://api.contoso.com/v1/ -w routes.txt -d 1 -t 5

# Authenticated scan with bearer token
feroxbuster -u https://portal.contoso.com -w common.txt -H "Authorization: Bearer <token>"

# Rate-limit to reduce alert risk
feroxbuster -u https://portal.contoso.com -w common.txt --rate-limit 50

# Auto-tune based on server error rates
feroxbuster -u https://portal.contoso.com -w common.txt --auto-tune

Evidence to Capture

• Newly identified directories and files
• Recursive findings that materially expand the attack surface
• Exact settings used for retest

Safety Boundaries

• Keep recursion, threading, and rate within approved limits.
• Stop if the application shows degradation or lockout behavior.