id = "feroxbuster" name = "feroxbuster" homepage = "https://epi052.github.io/feroxbuster/" description = "Fast, simple, recursive content discovery tool" executables = ["feroxbuster"] [dotfiles] # Feroxbuster's official configuration example documents ferox-config.toml in # the user's platform configuration directory (CONFIG_DIR/feroxbuster), while # also supporting the binary directory and /etc. The platform config locations # are the portable user paths represented here. # https://docs.rs/crate/feroxbuster/latest/source/ferox-config.toml.example paths = [ "[configHome]/feroxbuster/", "[appData]/feroxbuster/", "%APPDATA%/feroxbuster/", ] secret = [ "[configHome]/feroxbuster/ferox-config.toml", "[appData]/feroxbuster/ferox-config.toml", "%APPDATA%/feroxbuster/ferox-config.toml", ] [commands] format = 1 label = "Brute-force content discovery" description = "Scan a target URL with a wordlist for hidden paths. Filters, proxies, TLS certificates, request files and Burp options are left out." quality = "ai-draft" parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false } [[commands.source]] id = "help" kind = "help" url = "https://github.com/epi052/feroxbuster/blob/main/src/parser.rs" revision = "main 2026-10-27" evidence = """ -u, --url The target URL (required, unless [--stdin || --resume-from || --request-file] used) -w, --wordlist Path to the wordlist -x, --extensions File extension(s) to search for (ex: -x php -x pdf js) -t, --threads Number of concurrent threads (default: 50) -d, --depth Maximum recursion depth, a depth of 0 is infinite recursion (default: 4) -n, --no-recursion Do not scan recursively -s, --status-codes Status Codes to include (allow list) (default: All Status Codes) -k, --insecure Disables TLS certificate validation in the client -r, --redirects Allow client to follow redirects -H, --headers
Specify HTTP headers to be used in each request (ex: -H Header:val -H 'stuff:things') -a, --user-agent Sets the User-Agent (default: feroxbuster/x.y.z) -p, --proxy Proxy to use for requests (ex: http(s)://host:port, socks5(h)://host:port) -T, --timeout Number of seconds before a client's request times out (default: 7) -o, --output Output file to write results to (use w/ --json for JSON entries) -v, --verbosity Increase verbosity level (use -vv or more for greater effect) -q, --quiet Hide progress bars and banner (good for tmux windows w/ notifications) --silent Only print URLs (+ turns off logging) --json Emit JSON logs to --output and --debug-log instead of normal text --stdin Read url(s) from STDIN --rate-limit Limit number of requests per second (per directory) (default: 0, i.e. no limit) --auto-tune Automatically lower scan rate when an excessive amount of errors are encountered -e, --extract-links Extract links from response body (html, javascript, etc...); make new requests based on findings """ [[commands.field]] id = "url" label = "Target URL" type = "url" option = ["--url", "-u"] sources = ["help"] [[commands.field]] id = "wordlist" label = "Wordlist" type = "path" option = ["--wordlist", "-w"] path = { kind = "file", role = "input" } sources = ["help"] [[commands.field]] id = "extensions" label = "File extensions" description = "For example php, js, txt." type = "string" option = ["--extensions", "-x"] multiple = true sources = ["help"] [[commands.field]] id = "threads" label = "Threads" type = "integer" option = ["--threads", "-t"] sources = ["help"] [[commands.field]] id = "depth" label = "Recursion depth" description = "0 means unlimited." type = "integer" option = ["--depth", "-d"] sources = ["help"] [[commands.field]] id = "no_recursion" label = "Do not recurse" type = "boolean" option = ["--no-recursion", "-n"] sources = ["help"] [[commands.field]] id = "status_codes" label = "Status codes to include" type = "string" option = ["--status-codes", "-s"] multiple = true sources = ["help"] [[commands.field]] id = "extract_links" label = "Extract links from responses" type = "boolean" option = ["--extract-links", "-e"] sources = ["help"] [[commands.field]] id = "redirects" label = "Follow redirects" type = "boolean" option = ["--redirects", "-r"] sources = ["help"] [[commands.field]] id = "insecure" label = "Skip TLS verification" type = "boolean" option = ["--insecure", "-k"] sources = ["help"] [[commands.field]] id = "headers" label = "Headers" description = "Header:value" type = "string" option = ["--headers", "-H"] multiple = true sources = ["help"] [[commands.field]] id = "user_agent" label = "User-Agent" type = "string" option = ["--user-agent", "-a"] sources = ["help"] [[commands.field]] id = "proxy" label = "Proxy" type = "string" option = ["--proxy", "-p"] sources = ["help"] [[commands.field]] id = "timeout" label = "Request timeout (seconds)" type = "integer" option = ["--timeout", "-T"] sources = ["help"] [[commands.field]] id = "rate_limit" label = "Requests per second" type = "integer" option = ["--rate-limit"] sources = ["help"] [[commands.field]] id = "auto_tune" label = "Auto-tune rate" type = "boolean" option = ["--auto-tune"] sources = ["help"] [[commands.field]] id = "output" label = "Output file" type = "path" option = ["--output", "-o"] path = { kind = "file", role = "output" } effect = "overwrite" sources = ["help"] [[commands.field]] id = "quiet" label = "Quiet" type = "boolean" option = ["--quiet", "-q"] sources = ["help"] [[commands.field]] id = "silent" label = "URLs only" type = "boolean" option = ["--silent"] sources = ["help"] [[commands.field]] id = "verbosity" label = "Verbosity" type = "count" option = ["-v"] sources = ["help"] [[commands.task]] id = "scan" label = "Scan a site" fields = ["url", "wordlist", "extensions", "threads"] required = ["url", "wordlist"] [[commands.task]] id = "shallow" label = "Shallow scan, no recursion" fields = ["url", "wordlist", "extensions"] required = ["url", "wordlist"] set = { no_recursion = [true] } [[commands.group]] id = "basic" label = "Basic" fields = ["url", "wordlist", "extensions", "threads", "depth", "no_recursion", "status_codes", "extract_links", "output"] [[commands.group]] id = "advanced" label = "Advanced" fields = ["redirects", "insecure", "headers", "user_agent", "proxy", "timeout", "rate_limit", "auto_tune", "quiet", "silent", "verbosity"]