Directory scanning/busting more effectively

Hey there, thanks for the shout out! Ffuf, gobuster, and feroxbuster are all roughly equivalent as far as speed (when given the same level of concurrency).

My personal workflow is feroxbuster for enumeration followed by targeted fuzzing where appropriate with ffuf.

I’d suggest using feroxbuster with -e, which will comb through the response bodies and extract additional links for further scanning. It’s a built-in way to increase coverage that a wordlist on its own may miss.

The next release will add something similar, except it will automatically grab robots.txt and parse that as well.

I’m obviously biased, but ffuf, feroxbuster, and gobuster are all great choices.

If you have any suggestions for additional features or questions/issues, just open up an issue on GitHub.

1 Like