Scope
Scope Option
Section titled “Scope Option”The --scope option allows you to specify additional domains that should be considered “in-scope” during feroxbuster scans. This can help you avoid accidentally attacking endpoints or hosts that you don’t have permission to test.
Basic Usage
Section titled “Basic Usage”feroxbuster -u https://example.com --scope other-example.com example-sibling.comHow Scope Works
Section titled “How Scope Works”Default Behavior
Section titled “Default Behavior”By default, feroxbuster automatically includes the target URL’s domain in the scope list. When you specify additional URLs via --scope, they are added to this internal scope list along with the original target.
A URL is considered in-scope if:
- It belongs to the same domain as any URL in the scope list, OR
- It belongs to a subdomain of any domain in the scope list
So, any domain added to the scope is effectively wildcarded for subdomains, e.g. example.com => example.com || *.example.com
Automatic Scope Population
Section titled “Automatic Scope Population”The scope list is automatically populated with:
- The target URL from
--url(or URLs from--stdin) - Any domains/URLs you specify with
--scope
Scope Application
Section titled “Scope Application”The scope checking applies to:
- Redirect following (when
--redirectsis enabled) - Link extraction (assuming
--dont-extract-linksis false, which is the default) - Recursive directory scanning
URLs that fall outside the defined scope are automatically filtered out to prevent accidental scanning of unauthorized targets.
Configuration File
Section titled “Configuration File”You can also specify scope in your ferox-config.toml:
scope = ["example.com", "dev-example.com", "partner.otherdomain.com"]Examples
Section titled “Examples”Single Additional Domain
Section titled “Single Additional Domain”feroxbuster -u https://example.com --scope dev-example.comIn-scope URLs:
example.comand all its subdomains (from target URL)dev-example.comand all its subdomains (from —scope)
Multiple Domains
Section titled “Multiple Domains”feroxbuster -u https://example.com --scope dev-example.com partner.otherdomain.comIn-scope URLs:
example.comand all its subdomainsdev-example.comand all its subdomainspartner.otherdomain.comand all its subdomains
With Redirects
Section titled “With Redirects”feroxbuster -u https://example.com --scope dev-example.com --redirectsNow if example.com/login redirects to dev-example.com/auth/login, feroxbuster will follow the redirect because dev-example.com is in scope.
Related Options
Section titled “Related Options”--dont-scan: Use this to exclude specific URLs/domains (deny list)--redirects: Enable redirect following (scope applies to redirect targets)