id = "feroxbuster"
name = "feroxbuster"
homepage = "https://epi052.github.io/feroxbuster/"
description = "Fast, simple, recursive content discovery tool"
executables = ["feroxbuster"]
[dotfiles]
paths = [
"[configHome]/feroxbuster/",
"[appData]/feroxbuster/",
"%APPDATA%/feroxbuster/",
]
secret = [
"[configHome]/feroxbuster/ferox-config.toml",
"[appData]/feroxbuster/ferox-config.toml",
"%APPDATA%/feroxbuster/ferox-config.toml",
]
[commands]
format = 1
label = "Brute-force content discovery"
description = "Scan a target URL with a wordlist for hidden paths. Filters, proxies, TLS certificates, request files and Burp options are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }
[[commands.source]]
id = "help"
kind = "help"
url = "https://github.com/epi052/feroxbuster/blob/main/src/parser.rs"
revision = "main 2026-10-27"
evidence = """
-u, --url <URL> The target URL (required, unless [--stdin || --resume-from || --request-file] used)
-w, --wordlist <FILE> Path to the wordlist
-x, --extensions <FILE_EXTENSION> File extension(s) to search for (ex: -x php -x pdf js)
-t, --threads <THREADS> Number of concurrent threads (default: 50)
-d, --depth <RECURSION_DEPTH> Maximum recursion depth, a depth of 0 is infinite recursion (default: 4)
-n, --no-recursion Do not scan recursively
-s, --status-codes <STATUS_CODE> Status Codes to include (allow list) (default: All Status Codes)
-k, --insecure Disables TLS certificate validation in the client
-r, --redirects Allow client to follow redirects
-H, --headers <HEADER> Specify HTTP headers to be used in each request (ex: -H Header:val -H 'stuff:things')
-a, --user-agent <USER_AGENT> Sets the User-Agent (default: feroxbuster/x.y.z)
-p, --proxy <PROXY> Proxy to use for requests (ex: http(s)://host:port, socks5(h)://host:port)
-T, --timeout <SECONDS> Number of seconds before a client's request times out (default: 7)
-o, --output <FILE> Output file to write results to (use w/ --json for JSON entries)
-v, --verbosity Increase verbosity level (use -vv or more for greater effect)
-q, --quiet Hide progress bars and banner (good for tmux windows w/ notifications)
--silent Only print URLs (+ turns off logging)
--json Emit JSON logs to --output and --debug-log instead of normal text
--stdin Read url(s) from STDIN
--rate-limit <RATE_LIMIT> Limit number of requests per second (per directory) (default: 0, i.e. no limit)
--auto-tune Automatically lower scan rate when an excessive amount of errors are encountered
-e, --extract-links Extract links from response body (html, javascript, etc...); make new requests based on findings
"""
[[commands.field]]
id = "url"
label = "Target URL"
type = "url"
option = ["--url", "-u"]
sources = ["help"]
[[commands.field]]
id = "wordlist"
label = "Wordlist"
type = "path"
option = ["--wordlist", "-w"]
path = { kind = "file", role = "input" }
sources = ["help"]
[[commands.field]]
id = "extensions"
label = "File extensions"
description = "For example php, js, txt."
type = "string"
option = ["--extensions", "-x"]
multiple = true
sources = ["help"]
[[commands.field]]
id = "threads"
label = "Threads"
type = "integer"
option = ["--threads", "-t"]
sources = ["help"]
[[commands.field]]
id = "depth"
label = "Recursion depth"
description = "0 means unlimited."
type = "integer"
option = ["--depth", "-d"]
sources = ["help"]
[[commands.field]]
id = "no_recursion"
label = "Do not recurse"
type = "boolean"
option = ["--no-recursion", "-n"]
sources = ["help"]
[[commands.field]]
id = "status_codes"
label = "Status codes to include"
type = "string"
option = ["--status-codes", "-s"]
multiple = true
sources = ["help"]
[[commands.field]]
id = "extract_links"
label = "Extract links from responses"
type = "boolean"
option = ["--extract-links", "-e"]
sources = ["help"]
[[commands.field]]
id = "redirects"
label = "Follow redirects"
type = "boolean"
option = ["--redirects", "-r"]
sources = ["help"]
[[commands.field]]
id = "insecure"
label = "Skip TLS verification"
type = "boolean"
option = ["--insecure", "-k"]
sources = ["help"]
[[commands.field]]
id = "headers"
label = "Headers"
description = "Header:value"
type = "string"
option = ["--headers", "-H"]
multiple = true
sources = ["help"]
[[commands.field]]
id = "user_agent"
label = "User-Agent"
type = "string"
option = ["--user-agent", "-a"]
sources = ["help"]
[[commands.field]]
id = "proxy"
label = "Proxy"
type = "string"
option = ["--proxy", "-p"]
sources = ["help"]
[[commands.field]]
id = "timeout"
label = "Request timeout (seconds)"
type = "integer"
option = ["--timeout", "-T"]
sources = ["help"]
[[commands.field]]
id = "rate_limit"
label = "Requests per second"
type = "integer"
option = ["--rate-limit"]
sources = ["help"]
[[commands.field]]
id = "auto_tune"
label = "Auto-tune rate"
type = "boolean"
option = ["--auto-tune"]
sources = ["help"]
[[commands.field]]
id = "output"
label = "Output file"
type = "path"
option = ["--output", "-o"]
path = { kind = "file", role = "output" }
effect = "overwrite"
sources = ["help"]
[[commands.field]]
id = "quiet"
label = "Quiet"
type = "boolean"
option = ["--quiet", "-q"]
sources = ["help"]
[[commands.field]]
id = "silent"
label = "URLs only"
type = "boolean"
option = ["--silent"]
sources = ["help"]
[[commands.field]]
id = "verbosity"
label = "Verbosity"
type = "count"
option = ["-v"]
sources = ["help"]
[[commands.task]]
id = "scan"
label = "Scan a site"
fields = ["url", "wordlist", "extensions", "threads"]
required = ["url", "wordlist"]
[[commands.task]]
id = "shallow"
label = "Shallow scan, no recursion"
fields = ["url", "wordlist", "extensions"]
required = ["url", "wordlist"]
set = { no_recursion = [true] }
[[commands.group]]
id = "basic"
label = "Basic"
fields = ["url", "wordlist", "extensions", "threads", "depth", "no_recursion", "status_codes", "extract_links", "output"]
[[commands.group]]
id = "advanced"
label = "Advanced"
fields = ["redirects", "insecure", "headers", "user_agent", "proxy", "timeout", "rate_limit", "auto_tune", "quiet", "silent", "verbosity"]
