Feroxbuster is a robust tool designed to identify directories and files on web servers using brute-force techniques. It is frequently utilized in penetration testing and security evaluations to detect concealed paths and resources. Here we are going to discuss about various tasks which we can perform using Feroxbuster.

Table of contents

• Lab setup
• Installation
• Default mode
• Redirects
• Extensions
• Result output
• User agent
• Filter status code
• Quiet mode
• Controlling threads
• Custom wordlist
• Disable recursion
• Limit recursion depth
• Force Recursion
• Filter by character size
• Filter by number of words
• Filter by number of lines
• Filter by status code using deny list
• Filter by status code using allow list
• Generating random User-Agent
• HTTP methods
• Custom headers
• Cookies
• Adding slash
• Capturing requests in Burp
• Read target from list
• Resume from last state
• Follow redirect
• Timeout
• Comparasion between Feroxbuster and other tools
• Conclusion

Lab setup

Target Machine: 192.168.1.4

Attacker Machine: 192.168.1.31 (Kali Linux)

After setting up a web server in the target machine, we can proceed with the enumeration in the kali linux after installing Feroxbuster.

Installation

To install the Feroxbuster in kali linux, we can use the following command:

apt install feroxbuster

Default mode

Once we are done with the installation, we can proceed with the enumeration part. To perform a default directory brute force, we can use the following the command:

feroxbuster -u http://192.168.1.4

It can be seen from above that the wordlist used in default mode is the raft-medium-directories.txt.

To get a less verbose output, we can use the –silent flag to hide the non-essential data.

feroxbuster -u http://192.168.1.4 --silent

Redirects

In order to allow the Feroxbuster to continue the directory brute forcing on the redirected URL, we can use the -r or –redirect flag. For example if http://192.168.1.4 redirects to http://192.168.1.4/newpath, Feroxbuster will follow this redirection and continue to scan http://192.168.1.4/newpath for directories and files.

feroxbuster -u http://192.168.1.4 -r

Extensions

To perform brute-force for a particular type of file extension, the -x or –extensions flag can be used.

feroxbuster -u http://192.168.1.4 -x php,txt --silent

Result output

If we want to log the output, we use the –output flag and then mentioning the file name.

feroxbuster -u http://192.168.1.4 --output results.txt

User agent

To set up a custom user agent to send request at the server, we can use the -a or –user-agent flag. By default, the user agent used by Feroxbuster is feroxbuster/<version>.

feroxbuster -u http://192.168.1.4 -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

Filter status code

There are times when we need to skip certain status codes responses, so we can use the -C or –filter-status, to skip the results of the mentioned codes. If we want to include a particular status code in output, we can use the -s or –status-codes flag.

feroxbuster -u http://192.168.1.4 -C 403,404

Quiet mode

To present the output without showing the progress bar or banner, we can use the quite mode by giving the -q or –quiet flag.

feroxbuster -u http://192.168.1.4 -q

Controlling threads

To control the number of concurrent threads depending on the environment type, we can use the –threads or -t flag. The default threads value is 50.

feroxbuster -u http://192.168.1.4 -t 20

Custom wordlist

To use a custom wordlist, we can use the -w or –wordlist flag and then give the wordlist path. Here we are giving the common.txt file path.

feroxbuster -u http://192.168.1.4 -w /usr/share/wordlists/dirb/common.txt

Disable recursion

To allow the scanning of only top level directories, we can set the -n or –no-recursion flag to disable the recursive scanning.

feroxbuster -u http://192.168.1.4 -n

Limit recursion depth

To set a limit on the depth of recursion, we can use the -L or –scan-limit.

feroxbuster -u http://192.168.1.4 -L 4

Force Recursion

To ensure that the recursion is used, we can use the –force-recursion flag.

feroxbuster -u http://192.168.1.4 --force-recursion

Filter by character size

To filter out the messages of a particular length, we can use the -S or –filter-size flag. This will filter based on character size.

feroxbuster -u http://192.168.1.4 -q
feroxbuster -u http://192.168.1.4 -q -S 285,286,283,289

Filter by number of words

To filter out the results using number of words filter, we can use the -w or –filter-words flag.

feroxbuster -u http://192.168.1.4 -q
feroxbuster -u http://192.168.1.4 -q -W 33

Filter by number of lines

To filter out the results using number of words filter, we can use the -N or –filter-lines flag.

feroxbuster -u http://192.168.1.4 -q
feroxbuster -u http://192.168.1.4 -q -N 9

Filter by status code using deny list

To filter the results using status codes (deny list), we can use the –filter-status flag.

feroxbuster -u http://192.168.1.4 -q
feroxbuster -u http://192.168.1.4 -q --filter-status 404

Filter by status code using allow list

To filter the results using status codes (allow list), we can use the –status-codes flag.

feroxbuster -u http://192.168.1.4 -q
feroxbuster -u http://192.168.1.4 -q --status-codes 200,301

Generating random User-Agent

To use a random user agent for every request, we can use the -A flag. Here we have used the –burp flag simultaneously to show how the user agent looks in the requests.

feroxbuster -u http://192.168.1.4 -A --burp

HTTP methods

To explicitly define the HTTP methods to be used, we can use the -m flag and then state the method to be used like POST. The default method is GET while running the Feroxbuster.

feroxbuster -u http://192.168.1.4 -m POST

Custom headers

To explicitly define the request header to be used, we can use the -H flag and then state the header alongwith the value to be used like ‘Content-Type: application/x-www-form-urlencoded’. Here we have used the –burp flag simultaneously to show how the user agent looks in the requests.

feroxbuster -u http://192.168.1.4 -H 'Content-Type: application/x-www-form-urlencoded' --burp -q

Cookies

To use a specific cookie value in all the requests, we can mention the cookies header alongwith the value. The flag which can be used here is –cookies or -b. Here we have used the –burp flag simultaneously to show how the cookie looks in the requests.

feroxbuster -u http://192.168.1.4 --cookies PHPSESSID=t54ij15l5d51i2tc7j1k1tu4p4 --burp -q

Adding slash

To add a slash (/) after every request, we can use the -f or –add-slash flag.

feroxbuster -u http://192.168.1.4 -f

Capturing requests in Burp

To capture a request in Burp Suite, we can use the –burp flag while running the scan.

feroxbuster -u http://192.168.1.4 --burp

Read target from list

To perform the scanning on the targets provided in the list, we can use the following command:

cat target.txt
cat target.txt| feroxbuster --stdin -q

Resume from last state

If we wish to resume the scan from the last state, we can use the –resume-from flag and provide the .state file. There are times when we need to terminate the scan in between, so Feroxbuster will save the results in the file.

feroxbuster -u http://192.168.1.4 -q
feroxbuster --resume-from ferox-http_192_168_1_4-1723370176.state -q

Follow redirect

While scanning if there are requests which result in the redirection, so we can control that by allowing the clients to follow the redirects using -r flag.

feroxbuster -u http://192.168.1.4  -r

Timeout

To setup a timeout limit, we can use the -T flag. This determines the amount of time the Feroxbuster wil wait for the server response before terminating the scan. By default, this value is set to 7 seconds, however we can modify it by using the flag.

feroxbuster -u http://192.168.1.4

The above image shows the default timeout limit used and now we are going to modify it to 5 seconds.

feroxbuster -u http://192.168.1.4 -T 5

Comparasion between Feroxbuster and other tools

• Feroxbuster stands out for its comprehensive set of features, including extensive response filtering, Burp Suite integration, and customization options. It provides a balance between advanced functionality and user control, making it a powerful choice for detailed and nuanced directory and file brute-forcing.
• DirBuster is user-friendly with its GUI but may not be as fast or flexible as command-line tools like Feroxbuster.
• Gobuster offer speed and efficiency but with fewer advanced features and less flexibility compared to Feroxbuster.
• ffuf provides high performance and extensive filtering but can be complex to configure and use.

Conclusion

In conclusion, we can say that Feroxbuster is an excellent choice for those requiring precise control over their scanning processes, advanced filtering capabilities, and the ability to integrate with other tools.

Author: Vinayak Chauhan is an InfoSec researcher and Security Consultant. Contact here