> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/enumeration/web-enumeration.md).

# Web Enumeration

Web enumeration is the process of identifying, fingerprinting, and analyzing web applications and services to uncover potential attack vectors. It includes port scanning, service detection, directory brute-forcing, HTTP method discovery, and technology fingerprinting.

***

### Port Scanning

Identify open TCP ports where web services may be hosted (commonly 80, 443, 8080, 8000, etc.).

#### Tool: `nmap`

```bash
nmap -v -Pn -T4 -p- <target> -oA nmap-open-ports
```

> Scans all 65535 ports to find web service entry points.

***

### Service Detection and OS Fingerprinting

Enumerate services, versions, and possible OS information to identify vulnerable software.

#### Tool: `nmap`

```bash
nmap -v -T4 -sC -sV -A <target> -oA nmap-aggressive
```

* `-sC`: Run default scripts
* `-sV`: Service version detection
* `-A`: Aggressive scan including OS detection and traceroute

These Nmap NSE scripts are useful during web enumeration:

| Script             | Purpose                                   |
| ------------------ | ----------------------------------------- |
| `http-enum`        | Enumerates common files/directories       |
| `http-methods`     | Lists allowed HTTP methods                |
| `http-put`         | Tests for PUT support                     |
| `http-shellshock`  | Checks for Shellshock vulnerability       |
| `http-php-version` | Detects PHP version                       |
| `http-webdav-scan` | Identifies WebDAV-related vulnerabilities |

#### Example:

```bash
nmap -p 80,443 --script=http-enum,http-methods,http-put,http-shellshock <target>
```

***

### Manual Research on Services

Search public exploit databases for vulnerabilities in discovered services and versions.

#### Resources:

* Google: `"Apache 2.4.49 exploit site:exploit-db.com"` , `exploit github`
* [Exploit-DB](https://www.exploit-db.com/)
* [CVE Details](https://www.cvedetails.com/)
* [SearchSploit](https://github.com/offensive-security/exploitdb)

***

### Exploiting Vulnerable Services

Leverage identified vulnerabilities to gain access (e.g., file upload, remote code execution).

**Example**:

* Reverse shell via command injection or file upload
* Abusing outdated CMS plugins or misconfigured services

***

### Web Technology Fingerprinting

Identify backend technologies, CMS platforms, frameworks, and versions.

#### Tools:

* `WhatWeb`
* `Wappalyzer` (Browser Extension)
* `BuiltWith`
* `CMSeek` (for CMS detection)
* Manual inspection of HTTP headers and source code

***

### Directory and File Brute-Forcing

Discover hidden directories, configuration files, admin panels, and development artifacts.

#### Tools:

* `dirsearch`
* `gobuster`
* `feroxbuster`
* `wfuzz`

#### Common Wordlists:

* `/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt`
* `/usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt`

#### Common Files

* `sitemap.xml`
* `crossdomain.xml`
* `clientaccesspolicy.xml`
* `.well-known/`
* `readme.txt`
* `readme.md`
* `readme.html`
* `license.txt`

#### Example:

```bash
gobuster dir -u http://<target> -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,html,txt -t 50
```

***

### Standard Tools for Vulnerability Scanning

#### Nikto

```bash
nikto -C all -h {Target_IP/Domain}
```

#### Nuclei (for fast scanning using templates)

```bash
nuclei -u {Target_IP/Domain}
```

***

### HTTP Method Enumeration

Identify enabled HTTP methods that can be abused (e.g., PUT, DELETE, TRACE).

#### Tools:

* Curl:

  ```bash
  curl -X OPTIONS http://<target> -i
  ```
* Nmap:

  ```bash
  nmap -p 80 --script=http-methods <target>
  ```

> Check if methods like `PUT` are enabled for file upload or `DELETE` for unauthorized deletion.

***

### File Upload Testing

Test upload functionality for reverse shell or web shell delivery.

#### Actions:

* Upload `.php`, `.php5`, `.phtml` files
* Try double extensions: `file.php.jpg`, `file.jpg.php`
* Intercept with Burp Suite and tamper headers

> Validate execution in upload directory or temp folders.

***

### CMS Enumeration and Exploitation

Identify CMS platforms (WordPress, Joomla, etc.) and enumerate installed themes/plugins/extensions.

#### Tools:

* `CMSeek`
* `wpscan` (for WordPress)
* Manual browsing and source code analysis

{% hint style="info" %}
Search for CMS Directory Structure

* WordPress: `/wp-admin`, `/wp-content`, `/wp-includes`
* Joomla: `/administrator`, `/components`, `/modules`
* Drupal: `/core`, `/sites`, `/modules`, `/themes`
  {% endhint %}

{% hint style="warning" %}
Configuration files often contain database credentials and sensitive environment variables:

* WordPress: `wp-config.php`
* Joomla: `configuration.php`
* Drupal: `sites/default/settings.php`
* Common: `.env`, `config.php`, `.htaccess`
  {% endhint %}

{% hint style="success" %}
Try accessing the CMS admin panel using:

* Default paths (e.g., `/wp-admin`, `/administrator`)
* Default or weak credentials (`admin:admin`, `admin:password`)
* Usernames discovered via blog posts or enumeration tools

**Test for Vulnerable Themes or Plugins**

**Check Registration and Account Creation Endpoints**
{% endhint %}

***

### Source Code and Client-Side Analysis

Analyze the frontend and static files for sensitive information and clues.

#### Checklist:

* View HTML source for hidden fields, comments, and JS files
* Inspect JavaScript for API keys, internal endpoints
* Check files like `/robots.txt`, `/sitemap.xml`, `.git`, `.env`, `.DS_Store`

{% hint style="success" %}
Tip: Use `cewl` to generate custom wordlists based on the target web application content.

Use `katan` crawling of the target site to identify all reachable endpoints.
{% endhint %}

***

### Authentication Testing

* Check for login forms
* Test default, weak, or leaked credentials
* Bypass authentication using tricks like SQLi, case sensitivity, logic flaws

> Once logged in, escalate privileges if possible.

***

### Check for Common Web Vulnerabilities

#### Manual and automated testing for:

* SQL Injection
* Command Injection
* LFI/RFI
* SSRF