↓ Skip to main content
Cameron Candau

80, 443 HTTP

HTTP / HTTPS Enumeration (80, 443)
#

Run nmap HTTP scripts
#

nmap --script=http-enum,http-headers,http-methods,http-robots.txt,http-title -p 80,443 $IP

Identify web stack
#

whatweb http://$IP

Check common files
#

curl http://$IP/robots.txt
curl http://$IP/sitemap.xml
curl http://$IP/.git/config
curl http://$IP/web.config

Enumerate directories
#

ffuf -u http://$IP/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-directories.txt -fc 404 -fs <size> -t 50

Enumerate files with extensions
#

ffuf -u http://$IP/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-files.txt -e .php,.html,.txt,.bak,.old,.zip -fc 404 -fs <size> -t 50

Fuzz vhosts
#

ffuf -u http://$IP -H "Host: FUZZ.domain.com" -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs <size>

Baseline a discovered vhost directly
#

curl -i http://$IP/ -H 'Host: admin.domain.com'

Search page source for clues
#

curl http://$IP | grep -i -E "(password|user|admin|login|sql|database|config)"

Baseline by status, size, and words
#

curl -i http://$IP/
ffuf -u http://$IP/FUZZ -w wordlist.txt -mc all

Check backup, source, and config leaks
#

curl http://$IP/.git/config
curl http://$IP/.env
curl http://$IP/config.php.bak
curl http://$IP/index.php~

Review JavaScript and endpoints
#

curl http://$IP/app.js
curl http://$IP/app.js | grep -Ei 'token|key|api|auth|upload|admin|/api/|/admin'