Tree's Notes
  • Overview
  • Tools & Cheatsheets
  • Hacking Methodology
  • Hands-on Practice
  • Linux
    • Linux Basics
  • Windows
    • Windows Basics
  • MacOS
    • MacOS Basics
  • Web
    • Web Basics
  • Mobile
    • iOS
    • Android
  • OS Agnostic
    • Template
  • Courses
    • Hack The Box
      • Bug Bounty Hunter
        • Module 1: Web Requests
        • Module 2: Introduction to Web Applications
        • Module 3: Using Web Proxies
        • Module 4: Information Gathering - Web Edition
        • Module 5: Attacking Web Applications with Ffuf
        • Module 6: JavaScript Deobfuscation
        • Module 7: Cross-Site Scripting (XSS)
        • Module 8: SQL Injection Fundamentals
        • Module 9: SQLMap Essentials
        • Module 10: Command Injections
        • Module 11: File Upload Attacks
        • Module 12: Server-Side Attacks
        • Module 13: Login Brute Forcing
        • Module 14: Broken Authentication
        • Module 15: Web Attacks
        • Module 16: File Inclusion
        • Module 17: Session Security
        • Module 18: Web Service & API Attacks
        • Module 19: Hacking Wordpress
        • Module 20: Bug Bounty Hunting Process
    • OffSec
      • 🦊EXP-301
        • Module 1: Windows User Mode Exploit Development: General Course Information
        • Module 2: WinDbg and x86 Architecture
        • Module 3: Exploiting Stack Overflows
        • Module 4: Exploiting SEH Overflows
        • Module 5: Introduction to IDA Pro
        • Module 6: Overcoming Space Restrictions: Egghunters
        • Module 7: Creating Custom Shellcode
        • Module 8: Reverse Engineering for Bugs
        • Module 9: Stack Overflows and DEP Bypass
        • Module 10: Stack Overflows and ASLR Bypass
        • Module 11: Format String Specifier Attack Part I
        • Module 12: Format String Specifier Attack Part II
        • Module 13: Trying Harder: The Labs
      • 🐙EXP-312
        • Module 1: macOS Control Bypasses: General Course Information
        • Module 2: Virtual Machine Setup Guide
        • Module 3: Introduction to macOS
        • Module 4: macOS Binary Analysis Tools
        • Module 5: The Art of Crafting Shellcodes
        • Module 6: The Art of Crafting Shellcodes (Apple Silicon Edition)
        • Module 7: Dylib Injection
        • Module 8: The Mach Microkernel
        • Module 9: XPC Attacks
        • Module 10: Function Hooking on macOS
        • Module 11: The macOS Sandbox
        • Module 12: Bypassing Transparency, Consent, and Control (Privacy)
        • Module 13: GateKeeper Internals
        • Module 14: Bypassing GateKeeper
        • Module 15: Symlink and Hardlink Attacks
        • Module 16: Injecting Code into Electron Applications
        • Module 17: Getting Kernel Code Execution
        • Module 18: Mach IPC Exploitation
        • Module 19: macOS Penetration Testing
        • Module 20: Chaining Exploits on macOS Ventura
        • Module 21: Mount(ain) of Bugs (archived)
      • ⚓IR-200
        • Module 1: Incident Response Overview
        • Module 2: Fundamentals of Incident Response
        • Module 3: Phases of Incident Response
        • Module 4: Incident Response Communication Plans
        • Module 5: Common Attack Techniques
        • Module 6: Incident Detection and Identification
        • Module 7: Initial Impact Assessment
        • Module 8: Digital Forensics for Incident Responders
        • Module 9: Incident Response Case Management
        • Module 10: Active Incident Containment
        • Module 11: Incident Eradication and Recovery
        • Module 12: Post-Mortem Reporting
        • Module 13: Incident Response Challenge Labs
      • 🐉PEN-103
      • 🐲PEN-200
        • Module 1: Copyright
        • Module 2: Penetration Testing with Kali Linux: General Course Information
        • Module 3: Introduction to Cybersecurity
        • Module 4: Effective Learning Strategies
        • Module 5: Report Writing for Penetration Testers
        • Module 6: Information Gathering
        • Module 7: Vulnerability Scanning
        • Module 8: Introduction to Web Application Attacks
        • Module 9: Common Web Application Attacks
        • Module 10: SQL Injection Attacks
        • Module 11: Client-side Attacks
        • Module 12: Locating Public Exploits
        • Module 13: Fixing Exploits
        • Module 14: Antivirus Evasion
        • Module 15: Password Attacks
        • Module 16: Windows Privilege Escalation
        • Module 17: Linux Privilege Escalation
        • Module 18: Port Redirection and SSH Tunneling
        • Module 19: Tunneling Through Deep Packet Inspection
        • Module 20: The Metasploit Framework
        • Module 21: Active Directory Introduction and Enumeration
        • Module 22: Attacking Active Directory Authentication
        • Module 23: Lateral Movement in Active Directory
        • Module 24: Enumerating AWS Cloud Infrastructure
        • Module 25: Attacking AWS Cloud Infrastructure
        • Module 26: Assembling the Pieces
        • Module 27: Trying Harder: The Challenge Labs
      • 🛜PEN-210
        • Module 1: IEEE 802.11
        • Module 2: Wireless Networks
        • Module 3: Wi-Fi Encryption
        • Module 4: Linux Wireless Tools, Drivers, and Stacks
        • Module 5: Wireshark Essentials
        • Module 6: Frames and Network Interaction
        • Module 7: Aircrack-ng Essentials
        • Module 8: Cracking Authentication Hashes
        • Module 9: Attacking WPS Networks
        • Module 10: Rogue Access Points
        • Module 11: Attacking Captive Portals
        • Module 12: Attacking WPA Enterprise
        • Module 13: bettercap Essentials
        • Module 14: Determining Chipsets and Drivers
        • Module 15: Kismet Essentials
        • Module 16: Manual Network Connections
      • 🔗PEN-300
        • Module 1: Evasion Techniques and Breaching Defenses: General Course Information
        • Module 2: Operating System and Programming Theory
        • Module 3: Client Side Code Execution With Office
        • Module 4: Phishing with Microsoft Office
        • Module 5: Client Side Code Execution With Windows Script Host
        • Module 6: Reflective PowerShell
        • Module 7: Process Injection and Migration
        • Module 8: Introduction to Antivirus Evasion
        • Module 9: Advanced Antivirus Evasion
        • Module 10: Application Whitelisting
        • Module 11: Bypassing Network Filters
        • Module 12: Linux Post-Exploitation
        • Module 13: Kiosk Breakouts
        • Module 14: Windows Credentials
        • Module 15: Windows Lateral Movement
        • Module 16: Linux Lateral Movement
        • Module 17: Microsoft SQL Attacks
        • Module 18: Active Directory Exploitation
        • Module 19: Attacking Active Directory
        • Module 20: Combining the Pieces
        • Module 21: Trying Harder: The Labs
      • ⚛️SEC-100
      • 🛡️SOC-200
        • Module 1: Introduction to SOC-200
        • Module 2: Attacker Methodology Introduction
        • Module 3: Windows Endpoint Introduction
        • Module 4: Windows Server Side Attacks
        • Module 5: Windows Client-Side Attacks
        • Module 6: Windows Privilege Escalation
        • Module 7: Windows Persistence
        • Module 8: Linux Endpoint Introduction
        • Module 9: Linux Server Side Attacks
        • Module 10: Linux Privilege Escalation
        • Module 11: Network Detections
        • Module 12: Antivirus Alerts and Evasion
        • Module 13: Active Directory Enumeration
        • Module 14: Network Evasion and Tunneling
        • Module 15: Windows Lateral Movement
        • Module 16: Active Directory Persistence
        • Module 17: SIEM Part One: Intro to ELK
        • Module 18: SIEM Part Two: Combining the Logs
        • Module 19: Trying Harder: The Labs
      • TH-200
        • Module 1: Threat Hunting Concepts and Practices
        • Module 2: Threat Actor Landscape Overview
        • Module 3: Communication and Reporting for Threat Hunters
        • Module 4: Hunting With Network Data
        • Module 5: Hunting on Endpoints
        • Module 6: Theat Hunting Without IoCs
        • Module 7: Threat Hunting Challenge Labs
      • 🦉WEB-200
        • Module 1: Introduction to WEB-200
        • Module 2: Tools (archived)
        • Module 3: Web Application Enumeration Methodology
        • Module 4: Introduction to Burp Suite
        • Module 5: Cross-Site Scripting Introduction and Discovery
        • Module 6: Cross-Site Scripting Exploitation and Case Study
        • Module 7: Cross-Origin Attacks
        • Module 8: Introduction to SQL
        • Module 9: SQL Injection
        • Module 10: Directory Traversal Attacks
        • Module 11: XML External Entities
        • Module 12: Server-side Template Injection - Discovery and Exploitation
        • Module 13: Command Injection
        • Module 14: Server-side Request Forgery
        • Module 15: Insecure Direct Object Referencing
        • Module 16: Assembling the Pieces: Web Application Assessment Breakdown
      • 🕷️WEB-300
        • Module 1: Introduction
        • Module 2: Tools & Methodologies
        • Module 3: ManageEngine Applications Manager AMUserResourcesSyncServlet SSQL Injection RCE
        • Module 4: DotNetNuke Cookie Deserialization RCE
        • Module 5: ERPNext Authentication Bypass and Remote Code Execution
        • Module 6: openCRX Authentication Bypass and Remote Code Execution
        • Module 7: openITCOCKPIT XSS and OS Command Injection - Blackbox
        • Module 8: Concord Authentication Bypass to RCE
        • Module 9: Server-Side Request Forgery
        • Module 10: Guacamole Lite Prototype Pollution
        • Module 11: Dolibarr Eval Filter Bypass RCE
        • Module 12: RudderStack SQLi and Coraza WAF Bypass
        • Module 13: Conclusion
        • Module 14: ATutor Authentication Bypass and RCE (archived)
        • Module 15: ATutor LMS Type Juggling Vulnerability (archived)
        • Module 16: Atmail Mail Server Appliance: from XSS to RCE (archived)
        • Module 17: Bassmaster NodeJS Arbitrary JavaScript Injection Vulnerability (archived)
    • SANS
      • FOR572
Powered by GitBook
On this page
  • Web Application Reconnaissance
  • Determine the Scope
  • Passive Information Gathering
  • Web Application Enumeration
  • Accessing the Enumeration Sandbox Application
  • Discovering Running Services
  • Banner Grabbing
  • Manual HTTP Endpoint Discovery
  • Automated HTTP Endpoint Discovery
  • Information Disclosure
  • Components with Vulnerabilities
  • Sourcing Wordlists
  • Common Wordlists
  • Creating Custom Wordlists
  • Types of Attacks
  • Authentication Bypass
  • Data Exfiltration
  • Remote Code Execution
  • Web Shells
  • Appendix
Edit on GitHub
  1. Courses
  2. OffSec
  3. WEB-200

Module 3: Web Application Enumeration Methodology

Web Application Reconnaissance

Determine the Scope

Identify what you can and can't touch.

Passive Information Gathering

Use tools like whois, DNSDumpster, crt.sh, Shodan, etc. to gather information without actively touching the target.

Web Application Enumeration

Accessing the Enumeration Sandbox Application

Start the VM and add it to your hosts file.

Discovering Running Services

Use nmap.

Banner Grabbing

Checking server headers with curl

kali@kali:~$ curl -I http://enum-sandbox      
HTTP/1.1 200 OK
Date: Thu, 18 Apr 2024 18:22:37 GMT
Server: Apache/2.4.52 (Ubuntu)
Content-Type: text/html; charset=utf-8
Content-Length: 2546
Vary: Accept-Encoding

Checking service banners with netcat

kali@kali:~$ netcat -v enum-sandbox 22 
enum-sandbox [192.168.50.108] 22 (ssh) open
SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6
^C

Manual HTTP Endpoint Discovery

Use Burp Suite's site map, check robots.txt along with sitemaps.xml.

Automated HTTP Endpoint Discovery

Use tools like hakrawler, gobuster, dirb, etc.

Example usage of hakrawler

kali@kali:~$ echo "http://enum-sandbox" | hakrawler -u
http://enum-sandbox/
http://enum-sandbox/services
http://enum-sandbox/banners
http://enum-sandbox/bannersExercise
http://enum-sandbox/manual/
http://enum-sandbox/automated/
http://enum-sandbox/auth
http://enum-sandbox/shells
http://enum-sandbox/manual/products
http://enum-sandbox/manual/reviews
http://enum-sandbox/manual/testimonials
http://enum-sandbox/manual/about
http://enum-sandbox/manual
http://enum-sandbox/shells/bind
http://enum-sandbox/shells/reverse
http://enum-sandbox/auth/login

Example usage of dirb

kali@kali:~$ dirb http://enum-sandbox

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Thu Apr 18 14:31:09 2024
URL_BASE: http://enum-sandbox/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://enum-sandbox/ ----
+ http://enum-sandbox/auth (CODE:308|SIZE:237)
+ http://enum-sandbox/banners (CODE:200|SIZE:1181)
+ http://enum-sandbox/favicon.ico (CODE:200|SIZE:15086)
+ http://enum-sandbox/manual (CODE:308|SIZE:241)
+ http://enum-sandbox/robots.txt (CODE:200|SIZE:162)
+ http://enum-sandbox/server-status (CODE:403|SIZE:277)

-----------------
END_TIME: Thu Apr 18 14:35:46 2024
DOWNLOADED: 4612 - FOUND: 6

Dirb options, focusing on the extension option

kali@kali:~$ dirb      

dirb <url_base> [<wordlist_file(s)>] [options]

========================= NOTES =========================
 <url_base> : Base URL to scan. (Use -resume for session resuming)
 <wordlist_file(s)> : List of wordfiles. (wordfile1,wordfile2,wordfile3...)

...

======================== OPTIONS ========================
...
 -X <extensions> / -x <exts_file> : Append each word with this extensions.
 -z <millisecs> : Add a milliseconds delay to not cause excessive Flood.

======================== EXAMPLES =======================
 dirb http://url/directory/ (Simple Test)
 dirb http://url/ -X .html (Test files with '.html' extension)
 dirb http://url/ /usr/share/dirb/wordlists/vulns/apache.txt (Test with apache.txt wordlist)
 dirb https://secure_url/ (Simple Test with SSL)

Information Disclosure

These are issues where unnecessary information is provided. Example: login page informing of the correct/incorrect usernamed and/or password.

In the above example, this error allows us to enumerate valid usernames.

Example usage of ffuf

kali@kali:~$ ffuf -w users.txt -u http://enum-sandbox/auth/login -X POST -d 'username=FUZZ&password=bar' -H 'Content-Type: application/x-www-form-urlencoded'

...

________________________________________________

 :: Method           : POST
 :: URL              : http://enum-sandbox/auth/login
 :: Wordlist         : FUZZ: /home/kali/users.txt
 :: Header           : Content-Type: application/x-www-form-urlencoded
 :: Data             : username=FUZZ&password=bar
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

t_jones     [Status: 200, Size: 2093, Words: 678, Lines: 66, Duration: 61ms]
foo         [Status: 200, Size: 2093, Words: 678, Lines: 66, Duration: 61ms]
tomjones    [Status: 200, Size: 2093, Words: 678, Lines: 66, Duration: 60ms]
tom.jones   [Status: 200, Size: 2093, Words: 678, Lines: 66, Duration: 59ms]
tom_jones   [Status: 200, Size: 2093, Words: 678, Lines: 66, Duration: 59ms]
t.jones     [Status: 200, Size: 2093, Words: 678, Lines: 66, Duration: 59ms]
:: Progress: [5/5] :: Job [1/1] :: 0 req/sec :: Duration: [0:00:00] :: Errors: 0 ::

Components with Vulnerabilities

Some frameworks, add-ons, plugins, etc. contain vulnerabilities.

Sourcing Wordlists

Common Wordlists

Creating Custom Wordlists

Running cewl and checking the results

kali@kali:~$ cewl --write output.txt --lowercase -m 4 http://enum-sandbox/manual
CeWL 6.1 (Max Length) Robin Wood (robin@digi.ninja) (https://digi.ninja/)

kali@kali:~$ tail output.txt          
vision
pushing
possibilities
problem
small
them
apply
logic
intuition
pursuit

Types of Attacks

Authentication Bypass

Trying to gain new permissions — use valid credentials, SQLi, brute force, hijacking, abusing CORS, etc.

Data Exfiltration

Extracting sensitive/restricted data from the target network.

Remote Code Execution

Executing commands on the target. Bind shell is listening on the target. Reverse shell calls back to our device.

Web Shells

Limited, shell-like interface through a script installed on the web server. Check out /usr/share/webshells/.

Appendix

Proxy Tools

Content Discovery Tools

Vulnerability Scanners

Specialty Tools

PreviousModule 2: Tools (archived)NextModule 4: Introduction to Burp Suite

Last updated 6 months ago

is great. So is .

is a robust platform that can perform security testing of web applications. It includes several tools that can help identify web application vulnerabilities. There's a simplified free version available, but the professional/commercial version offers more comprehensive tools.

(ZAP) is a free, open-source web application security scanner. It includes features to allow automated and manual testing for web application vulnerabilities.

has several versions of its debugging proxy tool. While this tool can capture and inspect HTTP traffic, it does not include any security tools.

is a content scanner that uses a wordlist to discover web resources through brute forcing.

is a multi-threaded content scanner. It can be run with a GUI or headless. It is typically included in Kali Linux by default.

is a brute forcing tool written in Go, which usually makes it more performant than DIRB or DirBuster. Gobuster also supports enumerating DNS subdomains, and and buckets.

is a web crawler that discovers URLs and JavaScript files.

is a comprehensive commercial vulnerability scanning tool. It can identify a variety of vulnerabilities and provides detailed reports and remediation recommendations.

provides a selection of security tools, including commercial cloud security, compliance, and scanning services.

is an open source vulnerability scanner maintained by .

is a free, open source web server scanner that can conduct comprehensive tests against web servers for various vulnerabilities.

is a web application brute forcing tool. We can use it for content discovery, fuzzing, or more advanced attacks.

is a web application brute forcing tool similar to Wfuzz, but written in Go.

is a tool for discovering and exploiting SQL injection vulnerabilities in a variety of database servers.

(MSF) is a pentesting framework with scanning and exploitation capabilities. While maintained by , it is frequently updated with new exploits by the community. For more information on using the Metasploit Framework, refer to OffSec's (MSFU).

🦉
SecLists
payloadsallthethings
Burp Suite
Zed Attack Proxy
Fiddler
DIRB
DirBuster
Gobuster
AWS S3
Google Cloud
Hakrawler
Nessus
Qualys
OpenVAS
Greenbone
Nikto
Wfuzz
ffuf
sqlmap
Metasploit Framework
Rapid7
Metasploit Unleashed
Login Page with Error Message disclosing information
Using Developer Tools to identify POST request parameters