feroxbuster

feroxbuster is designed to perform Forced Browsing, an attack aimed at enumerating and accessing resources not referenced by the web application but still accessible to an attacker. These resources may contain sensitive information such as source code, credentials, or internal network addressing. Also known as Predictable Resource Location, File Enumeration, Directory Enumeration, and Resource Enumeration.

The tool brute-forces directories using wordlists to uncover hidden files and directories. It supports recursion, multiple HTTP methods, custom headers, and various filtering options to refine scans. Ideal for web reconnaissance to identify potential vulnerabilities or exposed data.

feroxbuster offers advanced features like auto-tuning scan rates, dynamic word and extension collection, and integration with proxies like Burp for traffic analysis.

feroxbuster sends HTTP requests to target URLs using provided wordlists, appending paths to enumerate directories and files. It supports recursion up to a specified depth, extracts links from responses unless disabled, and filters results by status codes, sizes, word counts, and regex patterns. Multiple threads enable concurrent requests with rate limiting; dynamic collection gathers words and extensions from responses to expand the scan. Proxies and custom headers allow integration with analysis tools.