HOLUP / :jackolantern: Hacktoberfest :jackolantern: / Pre-release Version

I'm making this project public earlier than I normally would for Hacktoberfest. It is not done. I make no guarantees about master even being in a state where the tool works. I'll remove this message once things stabilize, which should be relatively soon.

If you want to submit a PR as part of hacktoberfest, I'm mostly working off of the items in the Pre-release project. It's very fluid as I've been working on it myself up to this point. I'll look at formalizing what's there into issues soon.

Happy Hacktoberfest!

feroxbuster

feroxbuster is a fast, simple, recursive content discovery tool written in Rust.

:confused: What the heck is a ferox anyway?

Ferox is short for Ferric Oxide. Ferric Oxide, simply put, is rust. The name rustbuster was taken, so I decided on a variation. :shrug:

:rocket: Quick Demo

:open_book: Table of Contents

• Downloads
• Installation
• Configuration
  • Default Values
  • ferox-config.toml
  • Command Line Parsing
• Example Usage
  • Multiple Values
  • Include Headers
  • IPv6, Non-recursive scan with INFO logging enabled
  • Read urls from STDIN; pipe only resulting urls out to another tool
  • Proxy traffic through Burp
  • Proxy traffic through a SOCKS proxy
  • Pass auth token via query parameter
• Comparison w/ Similar Tools

:floppy_disk: Downloads

There are pre-built binaries for the following systems:

• Linux x86
• Linux x86_64
• MacOS x86_64
• Windows x86
• Windows x86_64

:cd: Installation

For now, please see the Releases section. Eventually, feroxbuster will have additional install options to include cargo install and apt install.

:gear: Configuration

Default Values

Configuration begins with with the following built-in default values baked into the binary:

• timeout: 7 seconds
• follow redirects: false
• wordlist: /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
• threads: 50
• verbosity: 0 (no logging enabled)
• statuscodes: 200 204 301 302 307 308 401 403 405
• useragent: feroxbuster/VERSION
• recursion depth: 4
• auto-filter wildcards - true
• output: stdout

ferox-config.toml

After setting built-in default values, any values defined in a ferox-config.toml config file will override the built-in defaults. If ferox-config.toml is not found in the same directory as feroxbuster, nothing happens at this stage.

For example, say that we prefer to use a different wordlist as our default when scanning; we can set the wordlist value in the config file to override the baked-in default.

Notes of interest: - it's ok to only specify values you want to change without specifying anything else - variable names in ferox-config.toml must match their command-line counterpart

```toml

ferox-config.toml

wordlist = "/wordlists/jhaddix/all.txt" ```

A pre-made configuration file with examples of all available settings can be found in ferox-config.toml.example. ```toml

ferox-config.toml

Example configuration for feroxbuster

#

If you wish to provide persistent settings to feroxbuster, rename this file to ferox-config.toml and make sure

it resides in the same directory as the feroxbuster binary.

#

After that, uncomment any line to override the default value provided by the binary itself.

#

Any setting used here can be overridden by the corresponding command line option/argument

#

wordlist = "/wordlists/jhaddix/all.txt"

statuscodes = [200, 500]

threads = 1

timeout = 5

proxy = "http://127.0.0.1:8080"

verbosity = 1

quiet = true

output = "/targets/ellingsonmineralcompany/gibson.txt"

useragent = "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0"

redirects = true

insecure = true

extensions = ["php", "html"]

norecursion = true

addslash = true

stdin = true

dontfilter = true

depth = 1

sizefilters = [5174]

queries = [["name","value"], ["rick", "astley"]]

headers can be specified on multiple lines or as an inline table

#

inline example

headers = {"stuff" = "things"}

#

multi-line example

note: if multi-line is used, all key/value pairs under it belong to the headers table until the next table

is found or the end of the file is reached

#

[headers]

stuff = "things"

more = "headers"

```

Command Line Parsing

Finally, after parsing the available config file, any options/arguments given on the commandline will override any values that were set as a built-in or config-file value.

``` USAGE: feroxbuster [FLAGS] [OPTIONS] --url ...

FLAGS: -f, --addslash Append / to each request -D, --dontfilter Don't auto-filter wildcard responses -h, --help Prints help information -k, --insecure Disables TLS certificate validation -n, --norecursion Do not scan recursively -q, --quiet Only print URLs; Don't print status codes, response size, running config, etc... -r, --redirects Follow redirects --stdin Read url(s) from STDIN -V, --version Prints version information -v, --verbosity Increase verbosity level (use -vv or more for greater effect)

OPTIONS: -d, --depth Maximum recursion depth, a depth of 0 is infinite recursion (default: 4) -x, --extensions ... File extension(s) to search for (ex: -x php -x pdf js) -H, --headers