Purpose
Use this skill for fast recursive content discovery on approved web targets when the methodology supports deeper enumeration than a simple path list.
Phase Fit
- Primary: Discovery and Reconnaissance, Vulnerability Analysis
- Secondary: Retest and Closure
Use When
- Need recursive directory discovery on a confirmed web target.
- Need to explore likely hidden content with controlled depth.
- Need a repeatable CLI workflow for web content retesting.
Avoid When
- Recursion or threading could stress a fragile application.
- Broad content discovery would exceed the agreed impact level.
Inputs
- Confirmed base URL
- Narrow wordlist aligned to the hypothesis
- Recursion depth, thread count, and exclusions
Procedure
- Start with the shallowest depth and lowest thread count that can answer the question.
- Separate authenticated and unauthenticated discovery.
- Review results for real application content rather than noise.
- Escalate only the most credible paths to manual validation.
- Save the exact recursion settings for retest.
Command Syntax
Replace sample targets with approved in-scope assets.
# Basic directory scan
feroxbuster -u https://portal.contoso.com -w /usr/share/seclists/Discovery/Web-Content/common.txt -o contoso-ferox.txt
# Recursive scan with depth limit
feroxbuster -u https://portal.contoso.com -w common.txt -d 3 -o contoso-recursive.txt
# Include file extensions
feroxbuster -u https://portal.contoso.com -w common.txt -x php,aspx,html -o contoso-ext.txt
# API subdirectory scan
feroxbuster -u https://api.contoso.com/v1/ -w routes.txt -d 1 -t 5
# Authenticated scan with bearer token
feroxbuster -u https://portal.contoso.com -w common.txt -H "Authorization: Bearer <token>"
# Rate-limit to reduce alert risk
feroxbuster -u https://portal.contoso.com -w common.txt --rate-limit 50
# Auto-tune based on server error rates
feroxbuster -u https://portal.contoso.com -w common.txt --auto-tune
Evidence to Capture
- Newly identified directories and files
- Recursive findings that materially expand the attack surface
- Exact settings used for retest
Safety Boundaries
- Keep recursion, threading, and rate within approved limits.
- Stop if the application shows degradation or lockout behavior.