A simple, fast, recursive content discovery tool written in Rust

🦀 Releases ✨ Example Usage ✨ Contributing ✨ Documentation 🦀

😕 What the heck is a ferox anyway?

Ferox is short for Ferric Oxide. Ferric Oxide, simply put, is rust. The name rustbuster was taken, so I decided on a variation. 🤷

📖 Table of Contents

• Downloads
• Installation
  • Download a Release
  • Cargo Install
  • apt Install
• Configuration
  • Default Values
  • ferox-config.toml
  • Command Line Parsing
• Example Usage
  • Multiple Values
  • Include Headers
  • IPv6, Non-recursive scan with INFO logging enabled
  • Read urls from STDIN; pipe only resulting urls out to another tool
  • Proxy traffic through Burp
  • Proxy traffic through a SOCKS proxy
  • Pass auth token via query parameter
• Comparison w/ Similar Tools

💿 Installation

Download a Release

Releases for multiple architectures can be found in the Releases section. Builds for the following systems are currently supported:

• Linux x86
• Linux x86_64
• MacOS x86_64
• Windows x86
• Windows x86_64

Cargo Install

feroxbuster is published on crates.io, making it easy to install if you already have rust installed on your system.

cargo install feroxbuster

apt Install

Head to the Releases section and download feroxbuster_amd64.deb. After that, use your favorite package manager to install the .deb.

sudo apt install ./feroxbuster_amd64.deb

⚙️ Configuration

Default Values

Configuration begins with with the following built-in default values baked into the binary:

• timeout: 7 seconds
• follow redirects: false
• wordlist: /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
• threads: 50
• verbosity: 0 (no logging enabled)
• statuscodes: 200 204 301 302 307 308 401 403 405
• useragent: feroxbuster/VERSION
• recursion depth: 4
• auto-filter wildcards - true
• output: stdout

ferox-config.toml

After setting built-in default values, any values defined in a ferox-config.toml config file will override the built-in defaults.

feroxbuster searches for ferox-config.toml in the following locations (in the order shown): - /etc/feroxbuster/ (global) - CONFIG_DIR/ferxobuster/ (per-user) - The same directory as the feroxbuster executable (per-user) - The user's current working directory (per-target)

If more than one valid configuration file is found, each one overwrites the values found previously.

If no configuration file is found, nothing happens at this stage.

As an example, let's say that we prefer to use a different wordlist as our default when scanning; we can set the wordlist value in the config file to override the baked-in default.

Notes of interest: - it's ok to only specify values you want to change without specifying anything else - variable names in ferox-config.toml must match their command-line counterpart

```toml

ferox-config.toml

wordlist = "/wordlists/jhaddix/all.txt" ```

A pre-made configuration file with examples of all available settings can be found in ferox-config.toml.example. ```toml

ferox-config.toml

Example configuration for feroxbuster

#

If you wish to provide persistent settings to feroxbuster, rename this file to ferox-config.toml and make sure

it resides in the same directory as the feroxbuster binary.

#

After that, uncomment any line to override the default value provided by the binary itself.

#

Any setting used here can be overridden by the corresponding command line option/argument

#

wordlist = "/wordlists/jhaddix/all.txt"

statuscodes = [200, 500]

threads = 1

timeout = 5

proxy = "http://127.0.0.1:8080"

verbosity = 1

quiet = true

output = "/targets/ellingsonmineralcompany/gibson.txt"

useragent = "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0"

redirects = true

insecure = true

extensions = ["php", "html"]

norecursion = true

addslash = true

stdin = true

dontfilter = true

depth = 1

sizefilters = [5174]

queries = [["name","value"], ["rick", "astley"]]

headers can be specified on multiple lines or as an inline table

#

inline example

headers = {"stuff" = "things"}

#

multi-line example

note: if multi-line is used, all key/value pairs under it belong to the headers table until the next table

is found or the end of the file is reached

#

[headers]

stuff = "things"

more = "headers"

```

Command Line Parsing

Finally, after parsing the available config file, any options/arguments given on the commandline will override any values that were set as a built-in or config-file value.

``` USAGE: feroxbuster [FLAGS] [OPTIONS] --url ...

FLAGS: -f, --addslash Append / to each request -D, --dontfilter Don't auto-filter wildcard responses -h, --help Prints help information -k, --insecure Disables TLS certificate validation -n, --norecursion Do not scan recursively -q, --quiet Only print URLs; Don't print status codes, response size, running config, etc... -r, --redirects Follow redirects --stdin Read url(s) from STDIN -V, --version Prints version information -v, --verbosity Increase verbosity level (use -vv or more for greater effect)

OPTIONS: -d, --depth Maximum recursion depth, a depth of 0 is infinite recursion (default: 4) -x, --extensions ... File extension(s) to search for (ex: -x php -x pdf js) -H, --headers