What does smart mode enable?

--smart turns on link extraction, auto-tuning, word collection, and backup detection at once. --thorough also collects extensions and scans directory listings.

How does it avoid overwhelming a target?

Auto-tune lowers the request rate when errors rise and auto-bail stops a run that is clearly failing.

How do I pass targets and a wordlist?

Provide a url-list file of targets and a --wordlist of paths. Optionally set --extensions, --threads, and --status-codes to tune coverage and noise.

Can I get structured output?

Yes. Enable --json to emit JSON logs instead of text, which is easier for downstream nodes to parse.

When should I pick ffuf instead?

When you need FUZZ placed in query strings, POST bodies, or Host headers. feroxbuster is opinionated for recursive path discovery.

Updated Jul 15, 2026

Discovery

Map a site content tree with recursive path brute-force

Recursive content discovery with smart defaults and rich response filters.

Map a site's full content tree Discover more with smart mode Keep wide scans stable

overview

What feroxbuster does

After an HTTP prober marks a host live, feed feroxbuster a url-list and --wordlist. It brute-forces paths and recurses into discoveries down to --depth (default 4), so one run maps a content tree instead of a single level.

--smart turns on link extraction, auto-tune, word collection, and backup detection together. --thorough adds directory-listing scans and extension collection. Filter by --status-codes, size, lines, words, or regex to cut soft-404 noise.

Prefer ffuf when you need FUZZ in parameters or Host headers. Prefer katana when the job is link crawling, not wordlist brute-force. Enable --json on the managed node for structured paths in a file and folder output.

source github.com/epi052/feroxbuster

use cases

Where feroxbuster fits

Map a site's full content tree

Brute-force from a wordlist and let recursion walk into every directory it finds, so one run surfaces the whole reachable structure, not only the top level.

Discover more with smart mode

Turn on --smart to extract links, auto-tune the rate, collect words, and find backups in one flag, widening coverage without hand-tuning options.

Keep wide scans stable

Use auto-tune and auto-bail so the scan lowers its rate or stops when a target starts erroring, instead of hammering a struggling server.

Filter responses to cut noise

Filter out responses by status, size, line, word count, or regex so the output holds real hits rather than uniform soft-404 pages.

reference

feroxbuster inputs and flags

56 inputs

Name	Type	Flag	Description
url-list	FILE	·	List of target URLs to scan.
wordlist	FILE	--wordlist	Wordlist of paths and files to brute-force.
extensions	STRING	--extensions	File extension(s) to search for (ex: php pdf js).
depth	STRING	--depth	Maximum recursion depth; 0 is infinite (default 4).
smart	BOOLEAN	--smart	Enable extract-links, auto-tune, collect-words, and collect-backups.
threads	STRING	--threads	Number of concurrent threads (default 50).
status-codes	STRING	--status-codes	Status codes to include (default 200 204 301 302 307 308 401 403 405).
json	BOOLEAN	--json	Emit JSON logs instead of normal text.

Showing key inputs. feroxbuster exposes 56 inputs in total.

Full flag reference (56 inputs)

Name	Type	Flag	Description
data	FILE	--data	Request's Body - The file name starts with an `@` (ex: @post.bin)
json	BOOLEAN	--json	Emit JSON logs to output instead of normal text
depth	STRING	--depth	Maximum recursion depth, a depth of 0 is infinite recursion (default: 4)
proxy	STRING	--proxy	Proxy to use for requests (ex: http(s)://host:port, socks5(h)://host:port)
query	STRING	--query	Request's URL query parameters (ex: token=stuff)
quiet	BOOLEAN	--quiet	Hide progress bars and banner
smart	BOOLEAN	--smart	Set --extract-links, --auto-tune, --collect-words, and --collect-backups to true
silent	BOOLEAN	--silent	Only print URLs
cookies	STRING	--cookies	Specify HTTP cookies to be used in each request (ex: stuff=things)
headers	STRING	--headers	Specify HTTP headers to be used in each request (ex: Header:val)
methods	STRING	--methods	Which HTTP request method(s) should be sent (default: GET)
threads	STRING	--threads	Number of concurrent threads (default: 50)
timeout	STRING	--timeout	Number of seconds before a client's request times out (default: 7)
insecure	BOOLEAN	--insecure	Disables TLS certificate validation in the client
no-state	BOOLEAN	--no-state	Disable state output file (*.state)
parallel	STRING	--parallel	Run parallel feroxbuster instances
protocol	STRING	--protocol	Specify the protocol to use when targeting via --request-file or --url with domain only (default: https)
thorough	BOOLEAN	--thorough	Use the same settings as --smart and set --collect-extensions and --scan-dir-listings to true
url-list	FILE	·	List of target URLs
wordlist	FILE	--wordlist	Wordlist
add-slash	BOOLEAN	--add-slash	Append / to each request's URL
auto-bail	BOOLEAN	--auto-bail	Automatically stop scanning when an excessive amount of errors are encountered
auto-tune	BOOLEAN	--auto-tune	Automatically lower scan rate when an excessive amount of errors are encountered
dont-scan	STRING	--dont-scan	URL(s) or Regex Pattern(s) to exclude from recursion/scans
redirects	BOOLEAN	--redirects	Allow client to follow redirects
verbosity	STRING	·	Increase verbosity level (use -vv or more for greater effect. [CAUTION] 4 v's is probably too much)
client-key	FILE	--client-key	Add a PEM encoded private key for mutual authentication (mTLS)
extensions	STRING	--extensions	File extension(s) to search for (ex: php pdf js)
limit-bars	STRING	--limit-bars	Number of directory scan bars to show at any given time (default: no limit)
rate-limit	BOOLEAN	--rate-limit	Limit number of requests per second (per directory) (default: 0, i.e. no limit)
scan-limit	STRING	--scan-limit	Limit total number of concurrent scans (default: 0, i.e. no limit)
time-limit	STRING	--time-limit	Limit total run time of all scans (ex: --time-limit 10m)
user-agent	STRING	--user-agent	Sets the User-Agent (default: feroxbuster/2.7.1)
client-cert	FILE	--client-cert	Add a PEM encoded certificate for mutual authentication (mTLS)
dont-filter	BOOLEAN	--dont-filter	Don't auto-filter wildcard responses
filter-size	STRING	--filter-size	Filter out messages of a particular size (ex: 4927,1970)
resume-from	FILE	--resume-from	State file from which to resume a partially complete scan (ex. --resume-from ferox-1606586780.state)
dont-collect	STRING	--dont-collect	File extension(s) to Ignore while collecting extensions (only used with `collect-extensions`)
filter-lines	STRING	--filter-lines	Filter out messages of a particular line count (ex: 31,30)
filter-regex	STRING	--filter-regex	Filter out messages via regular expression matching on the response's body/headers (ex: -X '^ignore me$')
filter-words	STRING	--filter-words	Filter out messages of a particular word count (ex: 91,82)
no-recursion	BOOLEAN	--no-recursion	Do not scan recursively
random-agent	BOOLEAN	--random-agent	Use a random User-Agent
replay-codes	STRING	--replay-codes	Status Codes to send through a Replay Proxy when found (default: --status-codes value)
replay-proxy	STRING	--replay-proxy	Send only unfiltered requests through a Replay Proxy, instead of all requests
request-file	FILE	--request-file	Raw HTTP request file to use as a template for all requests
server-certs	FILE	--server-certs	Add custom root certificate(s) for servers with unknown certificates
status-codes	STRING	--status-codes	Status Codes to include (allow list) (default: 200 204 301 302 307 308 401 403 405)
collect-words	BOOLEAN	--collect-words	Automatically discover important words from within responses and add them to the wordlist
filter-status	STRING	--filter-status	Filter out status codes (deny list) (ex: 401)
collect-backups	STRING	--collect-backups	Automatically request likely backup extensions for "found" urls (default: ~, .bak, .bak2, .old, .1)
force-recursion	BOOLEAN	--force-recursion	Force recursion attempts on all 'found' endpoints (still respects recursion depth)
filter-similar-to	STRING	--filter-similar-to	Filter out pages that are similar to the given page (ex: http://site.xyz/soft404)
scan-dir-listings	BOOLEAN	--scan-dir-listings	Force scans to recurse into directory listings (default: false)
collect-extensions	BOOLEAN	--collect-extensions	Automatically discover extensions and add them to --extensions (unless they're in `dont-collect`)
dont-extract-links	BOOLEAN	--dont-extract-links	Don't extract links from response body (html, javascript, etc...

example

Run feroxbuster

feroxbuster · command

# feroxbuster against example.com (url-list input on Trickest)feroxbuster --wordlist raft-small-directories.txt --smart --depth 3 --threads 50 --json

sample output

200      GET        48l      210w     4820c https://example.com/admin/301      GET         7l       32w      178c https://example.com/login -> /login/200      GET       120l      890w    22140c https://example.com/api/403      GET        10l       40w      564c https://example.com/backup/200      GET        33l      150w     3102c https://example.com/static/200      GET        15l       60w     1240c https://staging.example.com/config/# feroxbuster found 6 paths under example.com

guidance

Choosing feroxbuster

Use feroxbuster for recursive directory and file discovery on a live host, especially when --smart defaults help. For parameter or vhost fuzzing use ffuf; for link crawling use katana.

ffuf

General FUZZ engine for paths, parameters, and vhosts. feroxbuster is more opinionated and recurses by default.

gobuster

Simple directory brute-forcing. feroxbuster adds recursion, auto-tuning, and richer filtering.

dirsearch

Python content scanner with built-in wordlists. Same discovery step; feroxbuster is the Rust implementation with --smart defaults.

faq

feroxbuster questions

Yes. It walks into directories it discovers down to --depth (default 4), turning one run into a content-tree scan.

Run feroxbuster yourself

A target and a wordlist feed feroxbuster, which recursively brute-forces paths and writes the discovered content as a queryable output.

Run feroxbuster in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

url-list

FILE

List of target URLs to scan.

wordlist

FILE

--wordlist

Wordlist of paths and files to brute-force.

extensions

STRING

--extensions

File extension(s) to search for (ex: php pdf js).

depth

STRING

--depth

Maximum recursion depth; 0 is infinite (default 4).

smart

BOOLEAN

--smart

Enable extract-links, auto-tune, collect-words, and collect-backups.

threads

STRING

--threads

Number of concurrent threads (default 50).

status-codes

STRING

--status-codes

Status codes to include (default 200 204 301 302 307 308 401 403 405).

json

BOOLEAN

--json

Emit JSON logs instead of normal text.

Name

Type

Flag

Description

data

FILE

--data

Request's Body - The file name starts with an `@` (ex: @post.bin)

json

BOOLEAN

--json

Emit JSON logs to output instead of normal text

depth

STRING

--depth

Maximum recursion depth, a depth of 0 is infinite recursion (default: 4)

proxy

STRING

--proxy

Proxy to use for requests (ex: http(s)://host:port, socks5(h)://host:port)

query

STRING

--query

Request's URL query parameters (ex: token=stuff)

quiet

BOOLEAN

--quiet

Hide progress bars and banner

smart

BOOLEAN

--smart

Set --extract-links, --auto-tune, --collect-words, and --collect-backups to true

silent

BOOLEAN

--silent

Only print URLs

STRING

--cookies

Specify HTTP cookies to be used in each request (ex: stuff=things)

headers

STRING

--headers

Specify HTTP headers to be used in each request (ex: Header:val)

methods

STRING

--methods

Which HTTP request method(s) should be sent (default: GET)

threads

STRING

--threads

Number of concurrent threads (default: 50)

timeout

STRING

--timeout

Number of seconds before a client's request times out (default: 7)

insecure

BOOLEAN

--insecure

Disables TLS certificate validation in the client

no-state

BOOLEAN

--no-state

Disable state output file (*.state)

parallel

STRING

--parallel

Run parallel feroxbuster instances

protocol

STRING

--protocol

Specify the protocol to use when targeting via --request-file or --url with domain only (default: https)

thorough

BOOLEAN

--thorough

Use the same settings as --smart and set --collect-extensions and --scan-dir-listings to true

url-list

FILE

List of target URLs

wordlist

FILE

--wordlist

Wordlist

add-slash

BOOLEAN

--add-slash

Append / to each request's URL

auto-bail

BOOLEAN

--auto-bail

Automatically stop scanning when an excessive amount of errors are encountered

auto-tune

BOOLEAN

--auto-tune

Automatically lower scan rate when an excessive amount of errors are encountered

dont-scan

STRING

--dont-scan

URL(s) or Regex Pattern(s) to exclude from recursion/scans

redirects

BOOLEAN

--redirects

Allow client to follow redirects

verbosity

STRING

Increase verbosity level (use -vv or more for greater effect. [CAUTION] 4 v's is probably too much)

client-key

FILE

--client-key

Add a PEM encoded private key for mutual authentication (mTLS)

extensions

STRING

--extensions

File extension(s) to search for (ex: php pdf js)

limit-bars

STRING

--limit-bars

Number of directory scan bars to show at any given time (default: no limit)

rate-limit

BOOLEAN

--rate-limit

Limit number of requests per second (per directory) (default: 0, i.e. no limit)

scan-limit

STRING

--scan-limit

Limit total number of concurrent scans (default: 0, i.e. no limit)

time-limit

STRING

--time-limit

Limit total run time of all scans (ex: --time-limit 10m)

user-agent

STRING

--user-agent

Sets the User-Agent (default: feroxbuster/2.7.1)

client-cert

FILE

--client-cert

Add a PEM encoded certificate for mutual authentication (mTLS)

dont-filter

BOOLEAN

--dont-filter

Don't auto-filter wildcard responses

filter-size

STRING

--filter-size

Filter out messages of a particular size (ex: 4927,1970)

resume-from

FILE

--resume-from

State file from which to resume a partially complete scan (ex. --resume-from ferox-1606586780.state)

dont-collect

STRING

--dont-collect

File extension(s) to Ignore while collecting extensions (only used with `collect-extensions`)

filter-lines

STRING

--filter-lines

Filter out messages of a particular line count (ex: 31,30)

filter-regex

STRING

--filter-regex

Filter out messages via regular expression matching on the response's body/headers (ex: -X '^ignore me$')

filter-words

STRING

--filter-words

Filter out messages of a particular word count (ex: 91,82)

no-recursion

BOOLEAN

--no-recursion

Do not scan recursively

random-agent

BOOLEAN

--random-agent

Use a random User-Agent

replay-codes

STRING

--replay-codes

Status Codes to send through a Replay Proxy when found (default: --status-codes value)

replay-proxy

STRING

--replay-proxy

Send only unfiltered requests through a Replay Proxy, instead of all requests

request-file

FILE

--request-file

Raw HTTP request file to use as a template for all requests

server-certs

FILE

--server-certs

Add custom root certificate(s) for servers with unknown certificates

status-codes

STRING

--status-codes

Status Codes to include (allow list) (default: 200 204 301 302 307 308 401 403 405)

collect-words

BOOLEAN

--collect-words

Automatically discover important words from within responses and add them to the wordlist

filter-status

STRING

--filter-status

Filter out status codes (deny list) (ex: 401)

collect-backups

STRING

--collect-backups

Automatically request likely backup extensions for "found" urls (default: ~, .bak, .bak2, .old, .1)

force-recursion

BOOLEAN

--force-recursion

Force recursion attempts on all 'found' endpoints (still respects recursion depth)

filter-similar-to

STRING

--filter-similar-to

Filter out pages that are similar to the given page (ex: http://site.xyz/soft404)

scan-dir-listings

BOOLEAN

--scan-dir-listings

Force scans to recurse into directory listings (default: false)

collect-extensions

BOOLEAN

--collect-extensions

Automatically discover extensions and add them to --extensions (unless they're in `dont-collect`)

dont-extract-links

BOOLEAN

--dont-extract-links

Don't extract links from response body (html, javascript, etc...

200 GET 48l 210w 4820c https://example.com/admin/301 GET 7l 32w 178c https://example.com/login -> /login/200 GET 120l 890w 22140c https://example.com/api/403 GET 10l 40w 564c https://example.com/backup/200 GET 33l 150w 3102c https://example.com/static/200 GET 15l 60w 1240c https://staging.example.com/config/# feroxbuster found 6 paths under example.com

Map a site content tree with recursive path brute-force

What feroxbuster does

Where feroxbuster fits

Map a site's full content tree

Discover more with smart mode

Keep wide scans stable

Filter responses to cut noise

feroxbuster inputs and flags

Run feroxbuster

Choosing feroxbuster

ffuf

gobuster

dirsearch

feroxbuster questions

More Discovery tools

apkurlgrep

dirsearch

fallparams

gauplus

getJS

gittools-extractor

Run feroxbuster yourself

Map a site content tree with recursive path brute-force

What feroxbuster does

Where feroxbuster fits

Map a site's full content tree

Discover more with smart mode

Keep wide scans stable

Filter responses to cut noise

feroxbuster inputs and flags

Run feroxbuster

Choosing feroxbuster

ffuf

gobuster

dirsearch

feroxbuster questions

More Discovery tools

apkurlgrep

dirsearch

fallparams

gauplus

getJS

gittools-extractor

Run feroxbuster yourself