feroxbuster missed a folder?

[hartoyob]

so I have been using feroxbuster for a while and it has been my go-to tool replacing dirb and gobuster I used in the past.

There is something that I couldn't do with feroxbuster, however. I wonder if there is an option I miss.

I tested it on HTB openadmin. In this machine, the key is the /ona path (which is linked from /music -> login).
Feroxbuster missed this path while dirbuster (with default config) can get /ona quickly.

I thought I just need to pass -e on feroxbuster and it should find it; However it doesn't work.

dirbuster by default will do "parse html" - if I disable this, then it won't find it as well.
So what would be the equivalent of "parse html" in feroxbuster?

[epi052]

You're correct in that -e is what tells ferox to parse information from html.

I can take a look, but I don't have htb vip right now. Can you please provide the following:

• the raw html of the page where /ona lives?
• The command/config you used
• which version of ferox you're using and how you installed it

Thanks for bringing this up!

[hartoyob]

• Sure, please find the openadmin.tar.gz attached. It's the html of http://10.10.10.171/music where the login is linked to http://10.10.10.171/ona
• The command I use : feroxbuster -u http://10.10.10.171 -x php,txt -e
• I use feroxbuster 2.2.1 - from kali repository (apt install feroxbuster).
  openadmin.tar.gz

[epi052]

Right now -e only parses javascript style links and entries in robots.txt; it does not parse tags from html.

I honestly thought I had added parsing <a> tags, however, it appears that I did not (I know I played around with it at some point, I'm not sure why it didn't make it in).

If you'd like to add it as a feature request, that would be fine. However, I start an offsec course tomorrow and probably won't look at it for a month or two.

[joaociocca]

@epi052 allow me to hijack this discussion to ask one thing: I remember there being a -e flag but I don't see it on --help or on the documentation anymore. I do still see --dont-extract-links, though.

Did the -e became "on by default" and disabled by the --dont-extract-links?

I know I'm not crazy about the -e existence because I found this reference

feroxbuster/shell_completions/_feroxbuster

Line 93 in a583e2f

'-e[Extract links from response body (html, javascript, etc...); make new requests based on findings (default\: true)]' \

[epi052]

@joaociocca haha, yes. -e is now default behavior. The results were too good, and the performance hit so small, that it didn't make sense as an option anymore

[joaociocca]

awesome, thanks for the confirmation!