🗺️ HTTP Enumeration Flow
Manual
→
Tech ID
→
Dir Bust
→
VHost
→
Params
→
Vulns
Always start manual, then automate. Don't skip steps!
1
Manual Checks (Do These First!)
Always check these paths manually before running tools.
/robots.txt
/sitemap.xml
/.git/
/.svn/
/backup/
/admin/
Curl headers (check server, cookies, headers)
curl -I http://TARGET/
View source and comments
curl -s http://TARGET/ | grep -i "<!--\|password\|admin\|todo"
Check SSL certificate (for domains/emails)
openssl s_client -connect TARGET:443 2>/dev/null | openssl x509 -noout -text
✓ Git Dumper
Found /.git/? Use git-dumper http://TARGET/.git/ ./output to download the entire repo!
2
Technology Identification
Identify what technologies the target is running.
WhatWeb
Identify CMS, frameworks, plugins
whatweb http://TARGET/
Aggressive mode
whatweb -a 3 http://TARGET/
Wappalyzer / Builtwith
Wappalyzer CLI
wappalyzer http://TARGET/
Webanalyze (fast Go version)
webanalyze -host http://TARGET/
Browser extensions: Wappalyzer, BuiltWith, Retire.js
3
Directory Busting
Find hidden directories and files on the web server.
POPULAR Gobuster
Basic directory scan
gobuster dir -u http://TARGET/ -w <WORDLIST>
With extensions
gobuster dir -u http://TARGET/ -w <WORDLIST> -x php,txt,html,bak,zip
With cookies/auth + threads
gobuster dir -u http://TARGET/ -w <WORDLIST> -c "session=abc123" -t 50
RECURSIVE Feroxbuster
Auto-recursive (set it and forget it!)
feroxbuster -u http://TARGET/ -w <WORDLIST>
With extensions + depth limit
feroxbuster -u http://TARGET/ -x php,html,js -d 3 --no-recursion
Collect all URLs to file
feroxbuster -u http://TARGET/ --collect-extensions -o results.txt
FLEXIBLE FFUF
Basic (FUZZ = wordlist position)
ffuf -c -u http://TARGET/FUZZ -w <WORDLIST>
Filter by status code
ffuf -c -u http://TARGET/FUZZ -w <WORDLIST> -fc 404,403
Filter by response size
ffuf -c -u http://TARGET/FUZZ -w <WORDLIST> -fs 1234
-fc = filter code, -fs = filter size, -fw = filter words, -fl = filter lines
4
VHost / Subdomain Discovery
Find virtual hosts and subdomains on the same IP.
Virtual Host Fuzzing
Ffuf vhost discovery
ffuf -c -u http://TARGET/ -H "Host: FUZZ.domain.com" -w <WORDLIST> -fs SIZE
Gobuster vhost mode
gobuster vhost -u http://domain.com -w <WORDLIST> --append-domain
DNS Subdomain Enum
Gobuster DNS mode
gobuster dns -d domain.com -w <WORDLIST>
Subfinder (passive)
subfinder -d domain.com -o subs.txt
Amass (comprehensive)
amass enum -passive -d domain.com
⚠️ Add to /etc/hosts
Found a vhost? Add it: echo "10.10.10.10 newhost.domain.com" | sudo tee -a /etc/hosts
5
Parameter Fuzzing
Find hidden GET and POST parameters.
GET Parameters
Find hidden GET params
ffuf -c -u "http://TARGET/page.php?FUZZ=test" -w <WORDLIST> -fs SIZE
IDOR fuzzing (numeric IDs)
ffuf -c -u "http://TARGET/user?id=FUZZ" -w <(seq 1 1000)
POST Parameters
Find hidden POST params
ffuf -c -u http://TARGET/login -X POST -d "username=admin&FUZZ=test" -w <WORDLIST> -fs SIZE
Arjun (smart param finder)
arjun -u http://TARGET/page
✓ LFI/RFI Testing
Found a file parameter? Try: ?file=../../../etc/passwd or ?page=php://filter/convert.base64-encode/resource=index.php
6
CMS Scanning
Identify and enumerate Content Management Systems.
📝 WordPress
Enumerate plugins, users, themes
wpscan --url http://TARGET/ --enumerate p,u,t
Aggressive plugin detection
wpscan --url http://TARGET/ --enumerate p --plugins-detection aggressive
Password brute force
wpscan --url http://TARGET/ -U admin -P <WORDLIST>
p = plugins, u = users, t = themes, vp = vuln plugins
Other CMS
Drupal - droopescan
droopescan scan drupal -u http://TARGET/
Joomla - joomscan
joomscan -u http://TARGET/
CMSmap (multi-CMS)
cmsmap -t http://TARGET/
Magento - magescan
magescan scan:all http://TARGET/
7
Vulnerability Scanning
Scan for known web vulnerabilities.
Nikto
Basic web vulnerability scan
nikto -host http://TARGET/
Scan specific port with SSL
nikto -host TARGET -port 443 -ssl
Nmap HTTP Scripts
HTTP vulnerability scripts
nmap --script http-vuln* -p 80,443 TARGET
All HTTP scripts
nmap --script "http-*" -p 80 TARGET
Nuclei
Scan with all templates
nuclei -u http://TARGET/
Specific severity level
nuclei -u http://TARGET/ -severity critical,high
Specific tags (cve, lfi, sqli)
nuclei -u http://TARGET/ -tags cve,lfi,sqli
XSS Testing
XSStrike (automated scanner)
xsstrike -u "http://TARGET/search?q=test"
Dalfox (Go-based)
dalfox url "http://TARGET/search?q=test"
8
API Enumeration
Enumerate REST APIs, GraphQL, and JWT tokens.
API Discovery
Find API endpoints
ffuf -c -u http://TARGET/api/FUZZ -w <WORDLIST>
Kiterunner (smart API scanner)
kr scan http://TARGET/ -w routes-large.kite
GraphQL introspection
curl -X POST http://TARGET/graphql -H "Content-Type: application/json" -d '{"query":"{__schema{types{name}}}"}'
JWT Testing
Decode JWT (jwt_tool)
jwt_tool eyJhbGciOiJIUzI1NiIsInR5...
JWT none algorithm attack
jwt_tool TOKEN -X a
Crack JWT secret (hashcat)
hashcat -a 0 -m 16500 jwt.txt <WORDLIST>
Crack JWT secret (john)
john jwt.txt --wordlist=<WORDLIST> --format=HMAC-SHA256
9
Burp Suite Basics
Essential proxy tool for web pentesting.
Setup
1.
Proxy:
127.0.0.1:8080
2.
Firefox: FoxyProxy extension
3.
CA cert:
http://burp
Key Features
Proxy
Intercept & modify requests
Repeater
Manual request testing
Intruder
Automated attacks
Scanner
Active scan (Pro)
CLI proxy with curl
curl -x http://127.0.0.1:8080 -k https://TARGET/
10
Best Wordlists
Replace <WORDLIST> in commands above with these paths:
Directories
MEDIUM
/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
RAFT
/usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
QUICK
/usr/share/wordlists/dirb/common.txt
Subdomains & Params
SUBS
/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
PARAMS
/usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt
API
/usr/share/seclists/Discovery/Web-Content/api/api-endpoints.txt
Install SecLists
sudo apt install seclists # or
git clone https://github.com/danielmiessler/SecLists.git
🔗