# Feroxbuster

> Use for recursive web content discovery during authorized pentests. Trigger on hidden directory discovery, route enumeration, controlled recursion, and fast CLI coverage of approved web targets.

- Skill: `timsonner/feroxbuster` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/feroxbuster`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/feroxbuster/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/feroxbuster

---


# Feroxbuster

## Purpose

Use this skill for fast recursive content discovery on approved web targets when the methodology supports deeper enumeration than a simple path list.

## Phase Fit

- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Retest and Closure

## Use When

- Need recursive directory discovery on a confirmed web target.
- Need to explore likely hidden content with controlled depth.
- Need a repeatable CLI workflow for web content retesting.

## Avoid When

- Recursion or threading could stress a fragile application.
- Broad content discovery would exceed the agreed impact level.

## Inputs

- Confirmed base URL
- Narrow wordlist aligned to the hypothesis
- Recursion depth, thread count, and exclusions

## Procedure

1. Start with the shallowest depth and lowest thread count that can answer the question.
2. Separate authenticated and unauthenticated discovery.
3. Review results for real application content rather than noise.
4. Escalate only the most credible paths to manual validation.
5. Save the exact recursion settings for retest.

## Command Syntax

Replace sample targets with approved in-scope assets.

```bash
# Basic directory scan
feroxbuster -u https://portal.contoso.com -w /usr/share/seclists/Discovery/Web-Content/common.txt -o contoso-ferox.txt

# Recursive scan with depth limit
feroxbuster -u https://portal.contoso.com -w common.txt -d 3 -o contoso-recursive.txt

# Include file extensions
feroxbuster -u https://portal.contoso.com -w common.txt -x php,aspx,html -o contoso-ext.txt

# API subdirectory scan
feroxbuster -u https://api.contoso.com/v1/ -w routes.txt -d 1 -t 5

# Authenticated scan with bearer token
feroxbuster -u https://portal.contoso.com -w common.txt -H "Authorization: Bearer <token>"

# Rate-limit to reduce alert risk
feroxbuster -u https://portal.contoso.com -w common.txt --rate-limit 50

# Auto-tune based on server error rates
feroxbuster -u https://portal.contoso.com -w common.txt --auto-tune
```

## Evidence to Capture

- Newly identified directories and files
- Recursive findings that materially expand the attack surface
- Exact settings used for retest

## Safety Boundaries

- Keep recursion, threading, and rate within approved limits.
- Stop if the application shows degradation or lockout behavior.