feroxbuster

feroxbuster recurses into every directory it finds, so one command shows you the whole tree of the site. Filter the noise by status or size and limit the depth on large sites.

Platform: Linux · Windows · macOS (Rust)
Official site: github.com/epi052/feroxbuster
On HTB: 1 machine

Install

sudo apt install feroxbuster

feroxbuster cheat sheet

Your values Saved in this browser and applied to every cheatsheet.

Domain

5 commands

Useful options

With extensions and without 404s

feroxbuster -u http://box.htb -x php,txt -C 404

Limit the depth

feroxbuster -u http://box.htb --depth 2

Drop responses of a given size

feroxbuster -u http://box.htb -S 1234

Send it through Burp

feroxbuster -u http://box.htb --proxy http://127.0.0.1:8080 -k

In our cheatsheets

Web enumeration › Fuzzing

Recursive with feroxbuster

feroxbuster -u http://box.htb -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

HTB machines where feroxbuster is used

Taken from the chapters of IppSec videos where feroxbuster shows up. The ▶ link jumps to the minute of that part.

Hide the ones I have done

Analysis

hard windows

▶ Directory brute forcing (foothold)

Guides that use feroxbuster

Web fuzzing: directories, extensions, subdomains and vhosts with ffuf, gobuster and feroxbuster 3 min read Find hidden paths, backups, vhosts and exposed .git repos with ffuf and gobuster: which wordlist to use and how to filter out false positives.