epi052/feroxbuster · warning

word ( ) from wordlist is a URL, skipping...

Error message

word ({word}) from wordlist is a URL, skipping...

What it means

Url::format is responsible for turning a wordlist word into a request URL joined against the target. If the word itself parses as a complete URL, joining it to the base would produce wrong results (Url::join replaces the base), so the function logs a warning and returns an error to skip that word.

Solutions

1. Clean the wordlist to contain only bare path words (strip scheme://host prefixes)
2. Use a standard wordlist (e.g. seclists raw path lists) rather than URL lists
3. Ignore the warning - the word is safely skipped and scanning continues
4. Strip the target base from collected URLs before re-feeding them as a wordlist

Example fix

// before (wordlist.txt)
https://example.com/admin
// after (wordlist.txt)
admin

const is_full_url = (w: string) => /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(w);
const words = wordlist.filter(w => !is_full_url(w.trim()));

function isFullUrl(word: string): boolean {
  try { return !!new URL(word) && new URL(word).origin !== 'null'; } catch { return false; }
}

When it happens

Trigger: A wordlist contains a full URL (e.g. 'https://example.com/admin') instead of a bare path word; during format() the word passes Url::parse successfully and has the expected scheme, so processing is skipped.

Common situations: Using wordlists scraped from the web that contain absolute URLs, mixing recursive-scan output back into a wordlist, or accidentally pointing --wordlists at a file of URLs rather than words.

Understand the failure class

Background: "Invalid URL" errors: why new URL(), URI.parse, and reqwest::Url reject your string — missing scheme, whitespace, and bad path format — this error's family across 39 libraries.

Related errors

• Invalid request: Missing Host header and request line URI…
• Invalid request: Could not parse target URL
• Could not get underlying wordlist
• The url ' ' matches ; the scan will never start
• [ ] Unable to download wordlist from url

AI-assisted analysis of epi052/feroxbuster@1f595dab5c (2026-09-13). Data as JSON: /api/errors/e4ba9a69fcfb379c. Report an issue: GitHub.

Appendix: source

Thrown at src/url.rs:173

    /// Simple helper to generate a `Url`
    ///
    /// Errors during parsing `url` or joining `word` are propagated up the call stack
    pub fn format(&self, word: &str, extension: Option<&str>) -> Result<Url> {
        log::trace!("enter: format({word}, {extension:?})");

        if Url::parse(word).is_ok() {
            // when a full url is passed in as a word to be joined to a base url using
            // reqwest::Url::join, the result is that the word (url) completely overwrites the base
            // url, potentially resulting in requests to places that aren't actually the target
            // specified.
            //
            // in order to resolve the issue, we check if the word from the wordlist is a parsable URL
            // and if so, don't do any further processing
            let message = format!("word ({word}) from wordlist is a URL, skipping...");
            log::warn!("{message}");
            log::trace!("exit: format -> Err({message})");
            bail!(message);
        }

        // from reqwest::Url::join
        //   Note: a trailing slash is significant. Without it, the last path component
        //   is considered to be a “file” name to be removed to get at the “directory”
        //   that is used as the base
        //
        // the transforms that occur here will need to keep this in mind, i.e. add a slash to preserve
        // the current directory sent as part of the url
        let url = if word.is_empty() {
            // v1.0.6: added during --extract-links feature implementation to support creating urls
            // that were extracted from response bodies, i.e. http://localhost/some/path/js/main.js
            self.target.to_string()
        } else if !self.target.ends_with('/') {
            format!("{}/", self.target)
        } else {
            self.target.to_string()
        };

View on GitHub (pinned to 1f595dab5c)