Behavioral Web Reconnaissance & Fuzzing Engine
Built in Go • Open Source • Actively Developing
Features • Installation • Usage • Architecture • Roadmap • Security
Ferox is a Go-based behavioral web reconnaissance and fuzzing engine designed to find meaningful response differences instead of simply producing more HTTP results.
Traditional fuzzing can tell you:
/admin → 404
/login → 200
/api → 403
Ferox aims to ask a harder question:
Does this response behave differently enough from the expected baseline to deserve investigation?
The project focuses on turning large-scale reconnaissance into a smaller, more useful set of signals for security researchers and penetration testers.
⚠️ Authorized testing onlyUse Ferox only against infrastructure you own or targets explicitly authorized for security testing, such as systems covered by a bug bounty or penetration-testing engagement.
A large reconnaissance scan can produce thousands of responses.
The challenge isn't always finding more responses.
The challenge is identifying the responses that actually matter.
Ferox is being designed around:
- Behavioral response analysis
- Baseline-aware comparison
- Structural response fingerprinting
- Anomaly detection
- WAF/block-page awareness
- Discovery-driven follow-up
- High-concurrency scanning
- Explainable results
The long-term goal is simple:
Thousands of requests
↓
Response analysis
↓
Behavioral signals
↓
Ranked findings
↓
Human investigation
- Wordlist-based web discovery
FUZZsubstitutionFUZZ2secondary wordlist support- Extension expansion
- Concurrent request processing
- Global request-rate limiting
- Status-code filtering
- JSONL output
Ferox is designed to go beyond status-code filtering.
The response analysis pipeline includes:
Response
↓
Normalization
↓
Structural Fingerprint
↓
Baseline Comparison
↓
Clustering
↓
Anomaly Score
↓
Classification
Potential classifications include:
baseline
anomaly
waf_suspected
Ferox is designed to fail safely where possible:
- TLS verification enabled by default
- Redirects not automatically followed
- Request timeout limits
- Response body size limits
- Concurrency sanity checks
- Streamed primary wordlists
- Scan output excluded from Git
- Graceful Ctrl+C handling
See docs/SECURITY_PRACTICES.md for the reasoning behind these decisions.
- Go 1.22+
git clone https://github.com/YOUR_USERNAME/ferox.git
cd ferox
go build -o ferox ./cmd/feroxRun:
./ferox --help./ferox \
-u "https://target.example/FUZZ" \
-w wordlists/sample-small.txt./ferox \
-u "https://target.example/FUZZ" \
-w wordlist.txt \
-c 40./ferox \
-u "https://target.example/FUZZ" \
-w wordlist.txt \
-e .php,.bak,.old./ferox \
-u "https://target.example/FUZZ?param=FUZZ2" \
-w dirs.txt \
-w2 params.txt./ferox \
-u "https://target.example/FUZZ" \
-w wordlist.txt \
-rps 20./ferox \
-u "https://target.example/FUZZ" \
-w wordlist.txt \
-o results.jsonlOnly scan targets for which you have explicit authorization.
Current high-level pipeline:
Wordlist
│
▼
┌─────────────────┐
│ Job Generation │
│ FUZZ/FUZZ2/ext │
└────────┬────────┘
│
▼
Job Channel
│
▼
┌─────────────────┐
│ Worker Pool │
│ + Rate Limiter │
└────────┬────────┘
│
▼
HTTP Client
│
▼
Response
│
▼
Behavioral Analysis
│
┌──────┴──────┐
▼ ▼
Baseline Anomaly
│ │
└──────┬──────┘
▼
Output
Ferox separates request execution from response intelligence, allowing the behavioral analysis layer to evolve independently from the scanning engine.
See docs/ARCHITECTURE.md for deeper design decisions.
Ferox is being developed incrementally.
- Wordlist parsing
- HTTP requests
- Basic filtering
- Worker pool
- Rate limiting
-
FUZZ/FUZZ2 - Extension expansion
- JSONL output
- Panic recovery
- Test coverage
- Structural fingerprinting
- Response normalization
- Baseline calibration
- Response clustering
- Anomaly scoring
- WAF block-page detection
- Discovery-triggered sub-jobs
- JavaScript route extraction
- JSON endpoint extraction
- ID-like parameter discovery
- Discovery graph
- Adaptive rate limiting
- WAF-aware backoff
- Resume support
- TUI
- Discovery graph export
- Coverage tracking
- Scan methodology report
- WAF events
- Request statistics
- Anomaly summary
ferox/
├── cmd/
│ └── ferox/
│ └── main.go
│
├── internal/
│ ├── wordlist/
│ ├── httpclient/
│ ├── engine/
│ └── output/
│
├── docs/
│ ├── ARCHITECTURE.md
│ ├── SECURITY_PRACTICES.md
│ └── LEARNING_PLAN.md
│
├── wordlists/
│
├── .github/
│ └── workflows/
│
├── .gitignore
├── LICENSE
├── README.md
└── go.mod
Run the test suite:
go test ./...Run with the race detector:
go test ./... -raceRun static analysis:
go vet ./...Ferox is a security testing tool.
Please read docs/SECURITY_PRACTICES.md before using or contributing to the project.
Important design principles include:
- Safe-by-default HTTP behavior
- Explicit TLS exceptions
- Controlled concurrency
- Request timeouts
- Response-size limits
- No automatic redirects
- No secrets in source control
- Scan output treated as sensitive data
Ferox is intended for:
- Authorized penetration testing
- Bug bounty programs
- Security research on owned infrastructure
- Local security labs
- CTF environments
Do not use Ferox to scan systems without authorization.
Ferox is being developed in public.
Contributions, issues, discussions, and security-focused feedback are welcome.
Before contributing:
- Read the project documentation.
- Understand the security implications of your change.
- Add or update tests where appropriate.
- Keep security-sensitive behavior explicit.
- Document important design decisions.
MIT License.
See LICENSE for details.
Ferox
Behavioral reconnaissance. Less noise. More signal.