Pentesting.Site - Feroxbuster Cheat Sheet

Feroxbuster is a fast, recursive content discovery tool designed for web penetration testing. It efficiently scans websites and directories for hidden files, endpoints, and misconfigurations using brute-force techniques. With its multi-threaded approach, Feroxbuster helps pentesters uncover attack surfaces, aiding in web application pentesting and bug hunting.

Download Feroxbuster

Installation and Setup

1
curl -sLO https://github.com/epi052/feroxbuster/releases/latest/download/feroxbuster_amd64.deb.zip
2
unzip feroxbuster_amd64.deb.zip
3
sudo apt install ./feroxbuster_*_amd64.deb

1
pacman -S feroxbuster

1
choco install feroxbuster

1
docker pull epi052/feroxbuster
2
sudo docker run --init -it epi052/feroxbuster -u http://example.com -x js,html

1
brew install feroxbuster

1
sudo apt update && sudo apt install -y feroxbuster

1
sudo snap install feroxbuster

Basic Usage

1
feroxbuster -u http://example.com             #Basic Scan
2
feroxbuster -u http://example.com -v          #Verbose Output
3
feroxbuster -u http://example.com --silent    #Silent Mode (Only Results)
4
feroxbuster -u http://example.com --json      #JSON Output

Wordlists and Extensions

1
feroxbuster -u http://example.com -w /path/to/wordlist.txt                                  #Use Custom Wordlist
2
feroxbuster -u http://example.com -x php,html,txt                                           #Append File Extensions
3
feroxbuster -u http://example.com -x js,json,css -w mylist.txt                              #Combine Extensions & Wordlist
4
feroxbuster -u http://example.com -w /usr/share/seclists/Discovery/Web-Content/common.txt   #Use SecLists

Recursive Scanning

1
feroxbuster -u http://example.com -r                          #Enable Recursive Scanning
2
feroxbuster -u http://example.com -r --depth 3                #Set Maximum Recursion Depth
3
feroxbuster -u http://example.com -r --auto-tune              #Optimize for Recursion
4
feroxbuster -u http://example.com -r --scan-complete-signal   #Stop When Scan is Done

Filtering and Output

1
feroxbuster -u http://example.com --filter-size 1234              #Exclude Responses of Specific Size
2
feroxbuster -u http://example.com --filter-words 100              #Exclude Responses with X Words
3
feroxbuster -u http://example.com --filter-lines 20               #Exclude Responses with X Lines
4
feroxbuster -u http://example.com -o results.txt                  #Save Results to a File
5
feroxbuster -u http://example.com -o results.json -f json         #Save as JSON
6
feroxbuster -u http://example.com -s 200,204,301,302              #Include Only Certain Status Codes
7
feroxbuster -u http://example.com -C 403,404                      #Exclude Specific Status Codes
8
feroxbuster -u http://example.com --output-format=json --quiet    #JSON Output, No Progress Display

Performance Tuning

1
feroxbuster -u http://example.com -t 100                #Increase Threads for Faster Scanning
2
feroxbuster -u http://example.com --rate-limit 10       #Limit Requests Per Second
3
feroxbuster -u http://example.com --timeout 5           #Set Request Timeout
4
feroxbuster -u http://example.com --auto-tune           #Auto-Optimize for Speed
5
feroxbuster -u http://example.com --no-state            #Disable State File (For Large Scans)
6
feroxbuster -u http://example.com --scan-limit 5000     #Stop After 5000 Requests

Authentication and Proxies

1
feroxbuster -u http://example.com -H "Authorization: Basic <base64_credentials>"     #Basic Auth
2
feroxbuster -u http://example.com --proxy http://127.0.0.1:8080                      #Use HTTP Proxy
3
feroxbuster -u http://example.com --proxy socks5://127.0.0.1:9050                    #Use SOCKS5 Proxy
4
feroxbuster -u http://example.com --proxy 127.0.0.1:8080 --proxy-cred user:pass      #Proxy with Authentication
5
feroxbuster -u http://example.com -H "Cookie: sessionid=abc123"                      #Use Custom Cookies

Wildcard Handling

1
feroxbuster -u http://example.com --dont-filter                           #Disable Automatic Wildcard Filtering
2
feroxbuster -u http://example.com --filter-lines 10                       #Filter Responses with 10 Lines (Helps with Wildcards)
3
feroxbuster -u http://example.com --replay-proxy http://127.0.0.1:8080    #Replay Requests Through Proxy

Bypass Techniques

1
feroxbuster -u http://example.com -H "X-Original-URL: /admin"                  #Bypass Security Filters
2
feroxbuster -u http://example.com -H "X-Rewrite-URL: /admin"                   #Another Bypass Method
3
feroxbuster -u http://example.com -H "X-Custom-IP-Authorization: 127.0.0.1"    #WAF Evasion
4
feroxbuster -u http://example.com -H "X-Originating-IP: 127.0.0.1"             #Another WAF Bypass
5
feroxbuster -u http://example.com --url-encode                                 #Encode URLs to Evade Detection

Custom Headers and User-Agents

1
feroxbuster -u http://example.com -H "User-Agent: Mozilla/5.0"            #Set Custom User-Agent
2
feroxbuster -u http://example.com -H "Referer: https://google.com"        #Spoof Referrer
3
feroxbuster -u http://example.com --random-agent                          #Use Random User-Agent
4
feroxbuster -u http://example.com -H "X-Forwarded-For: 127.0.0.1"         #Spoof X-Forwarded-For

Combining Options

1
feroxbuster -u http://example.com -w /path/to/wordlist.txt -x php,html -r -t 100 -o results.txt          #Large Scan
2
feroxbuster -u http://example.com -w adminlist.txt --proxy socks5://127.0.0.1:9050                       #Stealth Scan via Proxy
3
feroxbuster -u http://example.com -H "Authorization: Bearer <token>" -r -o admin_panels.txt              #Admin Panel Discovery
4
feroxbuster -u http://example.com -H "User-Agent: Googlebot" -x php,html,js -o bot_scan_results.txt      #Mimic Googlebot

Troubleshooting

1
feroxbuster -u http://example.com --debug-log ferox_debug.log    #Debugging
2
feroxbuster -u http://example.com --verbose                      #Enable Verbose Output
3
feroxbuster -u http://example.com --no-recursion                 #Disable Recursion if Stuck
4
feroxbuster -u http://example.com --resume-from results.txt      #Resume from Last Scan

Best Practices

1
feroxbuster -u http://example.com -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -t 100 -r -o ferox_results.txt   #Large Scale Scanning
2
feroxbuster -u http://example.com -w custom-wordlist.txt --proxy socks5://127.0.0.1:9050                                             #Stealth Scanning via Proxy
3
feroxbuster -u http://example.com -x php,html,js -H "User-Agent: Googlebot" -o bot_scan_results.txt                                  #Mimic Web Crawlers
4
feroxbuster -u http://example.com --auto-tune --rate-limit 5 --proxy socks5://127.0.0.1:9050                                         #Optimized Stealth Scan