🌐 Web Enumeration

Service-level HTTP notes: 80-443-http. Web exploitation: sqli, lfi-traversal, file-upload, …

Directory / file brute-force

# gobuster
gobuster dir -u 192.168.50.20 -w /usr/share/wordlists/dirb/common.txt -t 5 -x php,html,txt
gobuster dir -u http://192.168.50.16:5002 -w /usr/share/wordlists/dirb/big.txt -p pattern
 
# feroxbuster (recursive, a bit nicer)
feroxbuster --url IP --depth 2 --wordlist /usr/share/wordlists/... -x aspx --cookies PHPSESSID=...

gobuster flags

-e full paths · -u url · -w wordlist · -U/-P basic auth · -p proxy · -c cookie · -k ignore cert
feroxbuster: -r follow redirects · -m GET,POST methods · -x extensions

Scanners & banner grabbing

nikto -h 192.168.0.X                       # web vuln scanner
whatweb http://192.168.0.11                # banner / tech stack

Also: Wappalyzer (tech stack), FoxyProxy (proxy switch).

Always check

• robots.txt, sitemap.xml, .htaccess, .git, /cgi-bin/
• Page source + JS files, browser debugger (hidden inputs), Network tab (headers)
• Use Burp Suite to tamper with requests

Wordlists

See 99-resources for paths (SecLists, raft-*, common.txt).