epi052/feroxbuster

Feroxbuster is a command-line content discovery tool written in Rust that performs automated web directory and file scanning. It features a modular architecture with an event-driven engine that handles HTTP requests, link extraction, and response filtering via configurable rules. The system supports advanced capabilities such as mutual TLS authentication, scope-aware redirect handling, and dynamic rate-limiting with auto-tuning to manage server load. Users can interact with active scans through a CLI menu to adjust parameters, manage queues, and monitor real-time statistics.

5 changes.

This period established the foundational structure of the feroxbuster project, including initial documentation, build configurations, and shell completion support. It also introduced significant core features such as a rewritten HTTP client with scope-aware redirect handling and mutual TLS, alongside comprehensive test infrastructure to ensure reliability.

10 changes.

The codebase underwent a comprehensive restructuring, replacing monolithic modules and global state with modular, event-driven architectures across filters, statistics, configuration, and the scanner. This refactoring introduced significant new capabilities, including an interactive scan management menu, dynamic auto-tuning, and enhanced link extraction, while also adding an internal NLP module for text analysis.

Users can now install the feroxbuster content discovery tool (version 2.8.0) via Chocolatey. This change introduces the complete package structure, including the nuspec metadata, installation and uninstallation scripts, and legal verification files, enabling straightforward management of the tool on Windows systems.

_choco\package · high confidence

A new \src/nlp\ module has been introduced to provide a standalone TF-IDF (Term Frequency-Inverse Document Frequency) library. This component includes utilities for text preprocessing (punctuation removal, case normalization, and stop-word filtering), a \Document\ struct for parsing and indexing text or HTML content, and a \TfIdf\ model for calculating term significance across a corpus. This internal capability supports features like word collection and post-processing logic within the application.

src/nlp · high confidence

This change introduces the foundational structure for the feroxbuster project, including the initial commit of the Rust source code, a Dockerfile for containerized builds, and a Makefile for local development and installation. It adds comprehensive documentation, such as a detailed README with installation instructions for various platforms (Kali, Homebrew, Chocolatey, etc.) and a CONTRIBUTING guide for developers. Additionally, it establishes contributor tracking via .all-contributorsrc, sets up code formatting rules with .rustfmt.toml, and provides an example configuration file (ferox-config.toml.example) to help users get started.

(repo-wide) · high confidence

An interactive Scan Management Menu has been added to the CLI, allowing users to manage active scans without restarting the tool. Users can now add new URLs to the scan queue, cancel specific or multiple active scans, create and remove filters (by status, lines, size, words, regex, or similarity), and adjust the concurrent scan limit. The menu also displays real-time progress information, including estimated time remaining and current scan permit usage, and supports hiding or showing progress bars to reduce terminal clutter.

_src/scan\manager · high confidence

Shell completion scripts are now provided for Bash, Zsh, Fish, Elvish, and PowerShell, enabling tab-completion for feroxbuster's command-line arguments. The scripts cover the full set of options including URL targeting, proxy settings, HTTP methods, headers, cookies, wordlists, filtering, recursion controls, and output formats, improving usability across major shells.

_shell\completions · high confidence

The statistics subsystem has been refactored from a single monolithic file into a structured module located at src/statistics. This change introduces separate modules for error definitions (StatError), field updates (StatField), and macro utilities (atomic\_increment, atomic\_load, atomic\_store), while the core Stats container and its serialization logic remain in container.rs. This reorganization improves code maintainability and clarity for the statistics tracking functionality without altering the external behavior of the scan reporting.

src/statistics · high confidence

The configuration logic has been reorganized into a dedicated \src/config\ module (container, utils, tests), introducing a structured \Configuration\ struct that centralizes settings. This change expands available options, adding support for multiple wordlists, replay proxies, mutual TLS (client certificates/keys), auto-tune/bail behaviors, and various filtering capabilities (status, size, regex, scope). It also updates default behaviors, such as enabling \extract\_links\ and \collect\_backups\ by default, and refines output levels to distinguish between quiet and silent modes.

src/config · high confidence

The filter logic in \src/filters\ has been reorganized into a modular structure, introducing a \FeroxFilters\ container to manage a collection of distinct filter types (status code, line count, word count, size, regex, similarity, and wildcard) and an initialization handler to wire them from configuration. A key behavioral change is that the regex filter (\-X\|--filter-regex\) now applies its pattern matching to both the response body and HTTP headers, whereas previously it likely only checked the body. Additionally, the wildcard filter logic has been refined to handle edge cases, such as zero-length responses, and the module now includes comprehensive tests for the new filter implementations.

src/filters · high confidence

The scan start banner has been restructured into a modular system (container and entry modules) that explicitly displays a comprehensive set of configuration parameters, including targets, status codes, filters, threading, timeouts, user agents, proxy settings, SSL/TLS identities (client key/cert, server certs), replay proxies, headers, extensions, methods, data, redirects, recursion limits, rate limits, parallel execution, auto-tune/bail behaviors, URL denylists, scopes, collection options (extensions, words, backups), and protocol settings. This change ensures users can clearly verify their scan configuration at startup.

src/banner · high confidence

The application has moved from using global configuration and state variables to a structured, asynchronous event system located in \src/event\_handlers\. This change introduces dedicated handlers for statistics, filters, output, scanning, and terminal input, all communicating via a \Command\ enum over unbounded channels. Users benefit from improved stability, as this architecture resolves previous race conditions and divide-by-zero errors, and enables new capabilities such as saving and resuming scan states via Ctrl+C and interactive menu management.

_src/event\handlers · high confidence

The HTTP client implementation has been rewritten to support scope-aware redirect policies, allowing scans to follow redirects only within specified target scopes rather than using a fixed limit. The client now supports mutual TLS authentication via client certificates and keys, and allows loading custom server certificates for validating connections. Redirect behavior is now configurable via a new \scope\ parameter in the client configuration, enabling more precise control over scan boundaries when following redirects.

src · high confidence

The link extraction logic in src/extractor has been restructured to use a new \ExtractorBuilder\ and \Extractor\ architecture. This change introduces support for three distinct extraction targets: \ResponseBody\ (scanning HTML/JS for links), \RobotsTxt\ (parsing sitemap directives), and \DirectoryListing\ (extracting links from HTML directory listings). The implementation replaces previous ad-hoc parsing with dedicated regular expressions (including an updated \LINKFINDER\_REGEX\) and integrates scope validation and asynchronous request handling directly into the extraction flow.

src/extractor · high confidence

The scanner logic has been refactored into a dedicated module (src/scanner) containing separate files for the main scanner (ferox\_scanner.rs), initialization (init.rs), rate-limit heap (limit\_heap.rs), policy data (policy\_data.rs), and the HTTP requester (requester.rs). This change introduces an auto-tuning mechanism that dynamically adjusts request rates based on error policies (403, 429, and general errors) using a custom heap-based limit adjustment system. It also fixes rate-limiting for low request-per-second values by using a 1-second interval with exact token refills, and adds support for interactive pause/resume commands during scans.

src/scanner · high confidence

This change adds a comprehensive suite of tests to the \tests/\ directory, significantly increasing test coverage for core components. It includes unit tests for the \DynamicSemaphore\ concurrency primitive (covering capacity changes and race conditions), integration tests for the banner output (validating display of proxies, headers, scope, and deny lists), and functional tests for the extractor (link following), filters (status code filtering), and deny list logic (preventing scans of specified URLs during extraction and recursion). Additionally, it introduces a new \tests/mutual-auth/\ directory with certificates and a Caddyfile configuration to support mTLS testing, along with test payloads and wordlists for policy and auto-bail integration tests.

tests · high confidence

This update releases version 2.13.1 of the feroxbuster content discovery tool. The Cargo.toml manifest reflects a comprehensive update of the Rust dependency tree, including major version bumps for core libraries such as tokio (1.47), reqwest (0.12), and clap (4.5), alongside updates to utilities like indicatif, console, and self\_update. These changes ensure compatibility with the latest Rust ecosystem standards and incorporate performance and security improvements from the underlying libraries.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 61 → 64 (+2.4)
• Rubric changed (rubric-2026.09.9 → rubric-2026.09.17) — scores are not directly comparable.

• Code Health 79 → 79 (+0.0)
• Architecture 100 → 86 (-14.5)
• Maturity 59 → 59 (+0.0)
• Readiness 66 → 65 (-0.5)
• Security 53 → 61 (+7.5)
• Performance 100 (new)

• Documentation: no installation or build instructions (README.md)
• Documentation: no usage examples (README.md)

• Ambiguous naming for similar retrieval operations. It is unclear what distinguishes a 'base' scan from a regular scan without reading implementation details, creating a cognitive load for API users.
• Dependency hygiene PARTLY measured — Cargo dependencies read, dependency currency not (crates.io unreachable)
• Flaky test: feroxbuster.scanner::requester::tests::tune_sets_expected_values_and_then_waits
• Medium vulnerability: RUSTSEC-2026-0285 (Cargo.lock)
• Projects may be oversized for their cohesion

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

epi052/feroxbuster was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.