feroxbuster - new forced browsing/directory busting tool

If you guys want to be able to use it from any directory I have found the line of code for that. “sudo cp feroxbuster /usr/local/bin/feroxbuster” ; That will move feroxbust to your bin so you can just put feroxbuster into the command promt and it pop up instead of finding it on your computer.

@DancinHype you’re correct. In fact, if you use the .deb file and install through apt, that will be handled for you. Additionally, an example config file will get placed in /etc/feroxbuster/

Install instructions for apt are GitHub - epi052/feroxbuster: A fast, simple, recursive content discovery tool written in Rust.

DNS resolution is provided by a library. It’s nothing I manage directly. I can hop on and test.

Can you re run your command with -vvvv -o trace.log and host it somewhere that I can get it?

Not gonna lie, it sounds like your environment, and not the tool, just as a heads up ?

I’ll be able to check it out this evening.

Sense worked fine:

ulimit -n 4096
./feroxbuster -u https://10.129.24.102 -k -w /usr/share/dirb/wordlists/common.txt

enterprise with /etc/hosts entry worked as well

./feroxbuster -u http://enterprise.htb -w /usr/share/dirb/wordlists/common.txt -d 2

Both were scanned with v1.0.5 of feroxbuster using pwnbox

Coming back to say I really have been enjoying this. Used it on a couple boxes, works like a charm and far superior to other tools.

Occasionally I’ll get errors like mentioned by @sparkla but it seems like you all discovered a fix. Thanks for making this i really love it.

Edit: One thing I’d like to see added is the ability to hide certain response codes. Currently you can choose a list of ones you would like to show, but for instance if I just wanted to hide 404 it would be nice to have a --hide flag and not have to type out every code I wanted to see.

Love the speed of this :slight_smile:

Haven’t checked out the new version yet but how about subdomain scanning?

Type your comment> @sparkla said:

Found the solution in the meantime - seems we’re just going too fast here:

See top answer:
networking - Increasing the maximum number of TCP/IP connections in Linux - Stack Overflow

sudo sysctl net.ipv4.ip_local_port_range=“15000 61000”
sudo sysctl net.ipv4.tcp_fin_timeout=30

nice find! I hadn’t considered increasing ephemeral port range, that’s pretty clever. I also like the TIME_WAIT reuse setting as another option. I’m going to add something like an FAQ/Wiki to document some of the OS level things like this that can be tweaked.

@LMAY75 said:
Coming back to say I really have been enjoying this. Used it on a couple boxes, works like a charm and far superior to other tools.

Glad to hear it!

Occasionally I’ll get errors like mentioned by @sparkla but it seems like you all discovered a fix. Thanks for making this i really love it.

Edit: One thing I’d like to see added is the ability to hide certain response codes. Currently you can choose a list of ones you would like to show, but for instance if I just wanted to hide 404 it would be nice to have a --hide flag and not have to type out every code I wanted to see.

Would you mind filing a feature request regarding the status code blacklist?

I love the fast feedback from this thread, but it’s not exactly the best place for me to track issues, lol.

@acidbat said:
Love the speed of this :slight_smile:

Thank you!

Haven’t checked out the new version yet but how about subdomain scanning?

I really don’t intend to branch out into other scanning areas. I’d prefer to keep making the busting functionality better rather than split time on a completely separate scanner (even if it’s housed in the same tool).

@epi said:

Would you mind filing a feature request regarding the status code blacklist?

Done :slight_smile:

Type your comment> @epi said:

@acidbat said:
Love the speed of this :slight_smile:

Thank you!

Haven’t checked out the new version yet but how about subdomain scanning?

I really don’t intend to branch out into other scanning areas. I’d prefer to keep making the busting functionality better rather than split time on a completely separate scanner (even if it’s housed in the same tool).

No worries mate :slight_smile:
End of the day it is your project after all :slight_smile: