feroxbuster

What's Changed

• add --scan-dir-listings by @epi052 in https://github.com/epi052/feroxbuster/pull/1192
• add --request-file by @epi052 in https://github.com/epi052/feroxbuster/pull/1192
• add --protocol by @epi052 in https://github.com/epi052/feroxbuster/pull/1192
• add --limit-bars by @epi052 in https://github.com/epi052/feroxbuster/pull/1192

Brief descriptions

• --request-file and --protocol - read in a raw http request file, from burp or similar
• --scan-dir-listings - force recursion into folders where directory listing is enabled
• --limit-bars - cap the number of progress bars displayed

Documentation

• --request-file and --protocol
• --scan-dir-listings
• --limit-bars

Special thanks to @Raymond-JV, @Tib3rius, @libklein, and @L1-0 for their suggestions and support 🎉

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.10.4...v2.11.0

What's Changed

• --filter-regex now looks at headers in addition to response body by @epi052 in https://github.com/epi052/feroxbuster/pull/1142
• clarified wording for headers in ferox-config.toml by @JulianGR in https://github.com/epi052/feroxbuster/pull/1152
• added winget releaser workflow by @sitiom in https://github.com/epi052/feroxbuster/pull/1155
• scan management menu now shows the estimated time left to scan by @epi052 in https://github.com/epi052/feroxbuster/pull/1142
• made --cookies parsing more robust by @epi052 in https://github.com/epi052/feroxbuster/pull/1142
• added ARM build for mac (aarch64-macos) to releases by @epi052 in https://github.com/epi052/feroxbuster/pull/1142
• fixed an issue where estimated time to complete would show 0s before the scan was finished by @epi052 in https://github.com/epi052/feroxbuster/pull/1142

New Contributors

• @JulianGR made their first contribution in https://github.com/epi052/feroxbuster/pull/1152
• @sitiom made their first contribution in https://github.com/epi052/feroxbuster/pull/1155

Special thanks 🙏

The following folks submitted bugs, PRs, and feature requests (in no particular order). They're the real MVPs.

• @JulianGR
• @L1-0
• @sitiom
• @wikamp-collaborator
• @sa7mon
• @swordfish0x0

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.10.3...v2.10.4

What's Changed

• 1105 - improve json logs for post processing by @epi052 in https://github.com/epi052/feroxbuster/pull/1114
• 1097 - included configuration field in state file by @epi052 in https://github.com/epi052/feroxbuster/pull/1114
• 1118 - using --data implies POST HTTP verb by @epi052 in https://github.com/epi052/feroxbuster/pull/1114
• 1122 - fixed mishandling of whitespace for supplied request headers by @epi052 in https://github.com/epi052/feroxbuster/pull/1114

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.10.2...v2.10.3

What's Changed

• removed scan target headers from feroxbuster-update check by @epi052 in https://github.com/epi052/feroxbuster/pull/1033
• --collect-backups accepts custom backup extension list by @epi052 in https://github.com/epi052/feroxbuster/pull/1035
• fixed issue where --silent included too much info on found dir by @epi052 in https://github.com/epi052/feroxbuster/pull/1067
• --parallel time limit enforced on individual directories instead of main thread by @epi052 in https://github.com/epi052/feroxbuster/pull/1072
• query fontconfig to determine if Noto Color Emoji is installed by @tritoke in https://github.com/epi052/feroxbuster/pull/1083
• updated upstream library that was causing tokio-runtime-worker panics; they're correctly reported as Err from the library now
• re-added .deb install method to releases
• fixed issue where early redirect loop would cause ferox to hang indefinitely

New Contributors

• @tritoke made their first contribution in https://github.com/epi052/feroxbuster/pull/1083

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.10.1...v2.10.2

What's Changed

• fixed scan menu range issue by @epi052 in https://github.com/epi052/feroxbuster/pull/936
• enable reading extensions from file by @andreademurtas in https://github.com/epi052/feroxbuster/pull/976
• fixed collect backups filtering by @epi052 in https://github.com/epi052/feroxbuster/pull/1016
• added http/2 support by @epi052 in https://github.com/epi052/feroxbuster/pull/1020
• allowed --json in conjunction with --silent by @epi052 in https://github.com/epi052/feroxbuster/pull/1022

New Contributors

• @andreademurtas made their first contribution in https://github.com/epi052/feroxbuster/pull/976

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.10.0...v2.10.1

What's Changed

• Adds server and client certificate management; enables mTLS by @lavafroth in https://github.com/epi052/feroxbuster/pull/892
  • --server-certs
  • --client-cert
  • --client-key

New Contributors

• @lavafroth made their first contribution in https://github.com/epi052/feroxbuster/pull/892 🎉

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.9.5...v2.10.0

What's Changed

• 878 support raw urls by @epi052 in https://github.com/epi052/feroxbuster/pull/884

special thanks to @aroly for reporting the issue, @lavafroth for the workaround, and @aancw for furthering the discussion! 🎉

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.9.4...v2.9.5

• reduced memory usage overall
• improved speed during link extraction
• updated dependencies. most significantly, indicatif, which hasn't been updated for well over a year (purposely postponed)
• added optional install path to install-nix.sh

What's Changed

• random improvements by @epi052 in https://github.com/epi052/feroxbuster/pull/877
• docs: add DrorDvash as a contributor for bug by @allcontributors in https://github.com/epi052/feroxbuster/pull/879

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.9.3...v2.9.4

What's Changed

• added extensions and status codes into auto filtering decision calculus by @epi052 in https://github.com/epi052/feroxbuster/pull/869

Special thanks to @0xdf223 for letting me know about the shortcoming 🥳

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.9.2...v2.9.3

What's Changed

• changed default value for --extract-links to true => added --dont-extract-links to turn off the new default behavior by @epi052 in https://github.com/epi052/feroxbuster/pull/834
• can load a wordlist from its url over http/https by @epi052 in https://github.com/epi052/feroxbuster/pull/834
• updated README with alternative installation methods for brew and chocolatey by @aancw in https://github.com/epi052/feroxbuster/pull/824
• fixed divide by zero error by @epi052 in https://github.com/epi052/feroxbuster/pull/834
• added check for forced recursion when directory listing detected by @epi052 in https://github.com/epi052/feroxbuster/pull/834

Special thanks to @aancw for the code, @acut3 for the bug report, and @xaeroborg for the nice quality of life idea 🎉

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.9.1...v2.9.2

What's Changed

• Implement auto update feature by @aancw in https://github.com/epi052/feroxbuster/pull/813
• scan management can now canx scans started with -u | --stdin | the menu itself by @epi052 in https://github.com/epi052/feroxbuster/pull/821
• feroxbuster can be installed via chocolatey by @aancw in https://github.com/epi052/feroxbuster/pull/807
• fix resume with offset when --methods | --extensions are used by @epi052 in https://github.com/epi052/feroxbuster/pull/823

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.9.0...v2.9.1

What's Changed

• banner is shown again after exiting scan management menu by @aancw in https://github.com/epi052/feroxbuster/pull/804
• improved auto-filtering accuracy
• Fixed issue where a wildcard redirect caused every request to recurse into that directory by @epi052 in https://github.com/epi052/feroxbuster/pull/808; id'd by @0xdf223
• fixed bug where --auto-tune and --rate-limit could be set in the same scan via --smart/--thorough composite settings; id'd by @GenericUser123

New Contributors

• @aancw made their first contribution in https://github.com/epi052/feroxbuster/pull/804 🥳

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.8.0...v2.9.0

What's Changed

• Fixes #761 | Updated Dockerfile and CONTRIBUTING docs by @aidanhall34 in https://github.com/epi052/feroxbuster/pull/762
• fixed bug in extractor that wasn't correctly comparing extracted domains
• fixed bug in Makefile
• fixed auto-bail icon; wasn't displaying properly on some terminals
• added visual cues for auto-tune's rate adjustments
• added visual cue when auto-bail is triggered
• when Content-Length header is missing or 0, now check the body length as well in case that differs
• fixed issue where auto-tune wasn't adjusting upward as often as it should have been
• added new methods for auto-detecting 404-like responses
• swapped ssdeep for simhash when creating similarity filters
• changed default allowed statuses to 'All Status Codes', new 404 detection should filter out what's unimportant and allow more responses through (i.e. apis)
• resume scan starts from offset in wordlist when a directory scan was partially complete
• docs: add aidanhall34 as a contributor for code, and infra by @allcontributors in https://github.com/epi052/feroxbuster/pull/764
• docs: add hakdogpinas as a contributor for ideas by @allcontributors in https://github.com/epi052/feroxbuster/pull/752
• docs: add duokebei as a contributor for ideas by @allcontributors in https://github.com/epi052/feroxbuster/pull/753
• docs: add joaociocca as a contributor for bug, and ideas by @allcontributors in https://github.com/epi052/feroxbuster/pull/790
• docs: add f3rn0s as a contributor for bug by @allcontributors in https://github.com/epi052/feroxbuster/pull/793
• docs: add pich4ya as a contributor for ideas by @allcontributors in https://github.com/epi052/feroxbuster/pull/799
• docs: add xaeroborg as a contributor for ideas by @allcontributors in https://github.com/epi052/feroxbuster/pull/800
• docs: add Luoooio as a contributor for ideas by @allcontributors in https://github.com/epi052/feroxbuster/pull/801

New Contributors

• @aidanhall34 made their first contribution in https://github.com/epi052/feroxbuster/pull/762

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.7.3...v2.8.0

What's Changed

• FIX 732 ensure --no-state is respected even through --time-limit by @kmanc in https://github.com/epi052/feroxbuster/pull/733
• Fix incorrect username in Contributors by @n0kovo in https://github.com/epi052/feroxbuster/pull/749
• fixed #716; wordlist entries with leading slash are trimmed by @epi052 in https://github.com/epi052/feroxbuster/pull/750
• fixed #743; redirects always show full url as Location by @epi052 in https://github.com/epi052/feroxbuster/pull/750
• fixed #748; cancelled scans persist across ctrl+c by @epi052 in https://github.com/epi052/feroxbuster/pull/750

New Contributors

• @kmanc made their first contribution in https://github.com/epi052/feroxbuster/pull/733
• @n0kovo made their first contribution in https://github.com/epi052/feroxbuster/pull/749

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.7.2...v2.7.3

What's Changed

• removed superfluous if statement by @herrcykel in https://github.com/epi052/feroxbuster/pull/580
• upgraded leaky-bucket to 0.12.1 by @udoprog in https://github.com/epi052/feroxbuster/pull/604
• updated dependencies by @epi052 in https://github.com/epi052/feroxbuster/pull/670
• upgraded clap from 3.x to 4.x by @epi052 in https://github.com/epi052/feroxbuster/pull/671
• 661 fix double dir scan by @epi052 in https://github.com/epi052/feroxbuster/pull/672
• fixed invalid uri exception during extraction by @epi052 in https://github.com/epi052/feroxbuster/pull/706

New Contributors

• @herrcykel made their first contribution in https://github.com/epi052/feroxbuster/pull/580
• @udoprog made their first contribution in https://github.com/epi052/feroxbuster/pull/604

Full Changelog: https://github.com/epi052/feroxbuster/compare/2.7.1...v2.7.2

What's Changed

• fixed bug in auto-tune
• extensions now accept values with leading period, i.e. -x .php and -x php behave identically (leading period gets stripped)
• if no url scheme is given, https is prepended to the target (-u hackerone.com becomes https://hackerone.com)
• support for secondary default wordlist location added (/usr/local/share/seclists...)

🎉 Special thanks to @jhaddix, @ippsec, @postmodern, and @DonatoReis for their reports / ideas 🎉

Full Changelog: https://github.com/epi052/feroxbuster/compare/2.7.0...2.7.1

What's Changed

• 535 status code filter overhaul by @epi052 in https://github.com/epi052/feroxbuster/pull/536

For a more in-depth explanation of how status code filtering has changed, please see the docs. Here are the cliff notes:

• --filter-status and --status-codes are now mutually exclusive options
• --status-codes works the same way it always has: by providing an allow-list for status codes. Any status code not included in --status-codes will be filtered out
• If a value is given to --filter-status, that status code will be filtered out, while all other status codes are allowed to proceed

Additionally, there is a new flag, --force-recursion. This flag tells feroxbuster to ignore its typical recursion logic in favor of recursing into any ‘found’ asset. A ‘found’ asset is an endpoint that was not filtered out by other scan settings (i.e. –filter-status or similar). More info available here.

Finally, the default path to the wordlist on windows has been updated to look in the current directory: .\SecLists\Discovery\Web-Content\raft-medium-directories.txt

🎉 Special thanks to @0xdf223 and @ThisLimn0 🎉

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.6.4...2.7.0

What's Changed

• bugfix where if multiple http methods were used, and returned responses that should have been shown to the user, only the first method was shown. This was an error in how responses were identified, but is now fixed.

Thanks to @godylockz for spotting another issue!

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.6.3...v2.6.4

What's Changed

• bugfix related to #501, --proxy was handled fine, but logic for --replay-proxy was flawed. Both exhibit the same behavior now.

Thanks to @godylockz for spotting the issue!

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.6.2...v2.6.3

• The Scan Management Menu now has the ability to manage filters as well! More details and demonstrations are available in the docs.

Special thanks to @jhaddix for the idea! 🎉

What's Changed

• add and remove filters via scan management menu by @epi052 in https://github.com/epi052/feroxbuster/pull/533 & https://github.com/epi052/feroxbuster/pull/528

Full Changelog: https://github.com/epi052/feroxbuster/compare/v2.6.1...v2.6.2