← Back to Academy

Academy Node

Feroxbuster Content Discovery

Feroxbuster brute-forces web paths and extensions to find hidden content.

Beginner100 XPWeb

Why it matters

Hidden dirs, backups, configs, and upload paths often become footholds.

How to identify it

  • Web app has unknown routes
  • Robots.txt hints
  • Default app with hidden admin

Linux commands

feroxbuster -u http://TARGET -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,txt,html,js,aspx,config,bak -k
feroxbuster -u http://TARGET -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html -k --filter-status 404

Expected output

  • 200/301/302/403 paths
  • Backup files
  • Admin directories

Success looks like

  • New functionality discovered
  • Sensitive file found

Failure looks like

  • Only noise and default pages

Troubleshooting

  • Filter by size
  • Try different extensions
  • Use hostname

Common mistakes

  • Not filtering false positives
  • Not testing extensions

Alternative attacks

  • VHost enumeration
  • Manual web review

What to try next

  • Check discovered files
  • Try default creds
  • Look for upload/RCE/LFI

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.