epi052/feroxbuster · error

The url ' ' matches ; the scan will never start

Error message

The url '{}' matches {}; the scan will never start

What it means

Companion to the regex check: get_targets compares each target against every entry in the URL denylist (--dont-scan with URL values) after trimming trailing slashes; an exact match means the base target itself would be denied, so the scan would never run and it bails. It protects against denying the very target being scanned.

Solutions

1. Remove the denylist entry identical to the base target
2. Use a more specific subpath (e.g. https://example.com/admin) instead of the root URL
3. Check the denylist for duplicates of the -u value, ignoring trailing slashes

Example fix

// before
ferox -u https://example.com --dont-scan https://example.com/
// after
ferox -u https://example.com --dont-scan https://example.com/static

const norm = u => u.replace(/\/+$/, ''); if (denyUrls.some(d => norm(d) === norm(targetUrl))) throw new Error('dont-scan url equals target');

When it happens

Trigger: Passing --dont-scan <url> where the value equals the base target modulo a trailing slash, e.g. ferox -u https://example.com --dont-scan https://example.com/

Common situations: Copy-pasting the target URL into the dont-scan list by mistake, or building denylists from previous scan output that includes the root URL.

Understand the failure class

Background: Conflicting config options: "cannot be used together" — configuration validation errors across open-source libraries — this error's family across 162 libraries.

Related errors

• The regex ' ' matches ; the scan will never start
• Empty query string provided
• Empty key in query string
• Empty header provided
• Empty header name provided

AI-assisted analysis of epi052/feroxbuster@1f595dab5c (2026-09-13). Data as JSON: /api/errors/1f61c3df93ef77bb. Report an issue: GitHub.

Appendix: source

Thrown at src/main.rs:195

        };
    } else {
        targets.push(handles.config.target_url.clone());
    }

    // remove footgun that arises if a --dont-scan value matches on a base url
    for target in targets.iter_mut() {
        for denier in &handles.config.regex_denylist {
            if denier.is_match(target) {
                bail!(
                    "The regex '{}' matches {}; the scan will never start",
                    denier,
                    target
                );
            }
        }
        for denier in &handles.config.url_denylist {
            if denier.as_str().trim_end_matches('/') == target.trim_end_matches('/') {
                bail!(
                    "The url '{}' matches {}; the scan will never start",
                    denier,
                    target
                );
            }
        }

        if !target.starts_with("http") {
            // --url hackerone.com
            // as of the 2.13.0 update, config::container handles both --url hackerone.com
            // and urls coming in from --stdin. I think this is dead code now, but leaving
            // it in just in case
            *target = format!("{}://{target}", handles.config.protocol);
        }
    }

    log::trace!("exit: get_targets -> {targets:?}");

View on GitHub (pinned to 1f595dab5c)