Skip to main content
Boderebe on Security

Feroxbuster, Gobuster, and DIRB: A Practical Speed Comparison

Jason J. Boderebe
2 min read
#web-security #penetration-testing #feroxbuster #gobuster #dirb #directory-brute-forcing

Welcome back!

Before you can exploit anything on a web app, you usually need to find it first. A lot of what actually matters on a target — admin login pages, leftover backup files, forgotten API endpoints, config files someone forgot to remove — never shows up in a link on the homepage. Content discovery is how you go looking for that stuff instead of hoping it’s handed to you.

The tooling for this has gone through a few generations. DIRB was the long-time default. Gobuster came along and pushed things faster with a leaner Go-based implementation. The newer contender is Feroxbuster — written in Rust, built around recursion, and marketed as the next step up in speed.

In this walkthrough, we’ll explore Feroxbuster and compare it with traditional directory brute-forcing tools to see how it stacks up.

What Feroxbuster Is Actually Built For

A few things define how it behaves:

  • Speed — it leans on Rust’s concurrency model to fire off requests in parallel rather than working through a wordlist sequentially
  • A CLI that doesn’t fight you — the flags are readable and the defaults are sane, so you’re not fighting the tool’s syntax before you’ve even scanned anything
  • Recursion by default — find a subdirectory, it automatically scans that too, no re-running the command yourself
  • Filtering that thinks a little — it tries to cut down on noisy false positives instead of just dumping every response back at you
  • Room to tune it — plenty of flags for adjusting threads, wordlists, and scan behavior once you outgrow the defaults

Step 1: Installation

On Kali, it’s already in the repos:

sudo apt install feroxbuster -y