A fast, simple, recursive content discovery tool written in Rust for forced browsing attacks.
Feroxbuster is a fast, recursive content discovery tool written in Rust that performs forced browsing attacks. It helps security professionals find hidden directories and files on web servers by brute-forcing paths with a wordlist, uncovering sensitive resources not linked by the application.
Penetration testers, security researchers, and bug bounty hunters who need to enumerate web application endpoints and discover hidden content during security assessments.
Developers choose Feroxbuster for its speed due to Rust implementation, simplicity of use, and rich feature set including proxy support, flexible filtering, and recursive scanning—making it a robust alternative to other directory enumeration tools.
A fast, simple, recursive content discovery tool written in Rust.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Written in Rust, feroxbuster delivers high-speed recursive scanning, making it efficient for large-scale directory enumeration tasks, as emphasized in the key features.
Supports HTTP/SOCKS proxies including Burp Suite, enabling traffic interception and analysis during scans, as demonstrated in the example usage with --proxy flags.
Allows filtering by response size, status codes, and custom headers, providing precise control over scan results and reducing noise in output.
Handles authentication via headers or query parameters and can send JSON/URL-encoded payloads with automatic Content-Type setting, simplifying testing of protected endpoints.
The extensive command-line options and separate documentation site (moved from a 1300-line README) can be overwhelming for users new to CLI tools or directory enumeration.
Requires external wordlists for scanning, adding an extra step compared to tools that include default lists, which may slow down initial setup for some users.
As a brute-force tool, it can generate a high volume of requests, risking server overload or triggering security alerts in production environments without careful throttling.