Nikto

This is an open source web scanner that looks for outdated versions, specific version problems, and other things

Syntax: nikto -host http://x.x.x.x
Through a proxy: nikto -host -useproxy http://<ip>:<port>

Gobuster

Gobuster is a command line tool that can brute force URI’s in websites. Gobuster is usually faster than Dirbuster, fwiw.

Syntax: gobuster dir -u http://x.x.x.x -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Through a Proxy: gobuster dir -u http://127.0.0.1 -p http://kalamari:ihateseafood@10.10.10.21:3128 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 40

Common Kali Wordlist Locations

  • /usr/share/wordlists/
  • /usr/share/wordlists/dirbuster/
  • /usr/share/wordlists/dirb/

Dirbuster

Wfuzz

Wfuzz is a tool for bruteforcing web applications. Documentation is available here: https://wfuzz.readthedocs.io/en/latest/

Syntax: wfuzz -c -w <wordlist> <http://x.x.x.x/FUZZ>

wfuzz -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-small.txt -z list,-.pdf –hc 404,403 https://intra.redcross.htb/documentation/FUZZFUZ2Z

  • -c = output with colors
  • You need to specify the word FUZZ where you want the wordlist to hit in the URL.

DirSearch

https://github.com/maurosoria/dirsearch

python3 dirsearch.py -u http://<IP address> -e php,html -x 400,401,403

WebDAV / davtest

WebDAV is an extension of HTTP that allows clients to perform remove Web content authoring. If you see it on a target, you can use a tool called davtest to try to enumerate.

Syntax: /usr/bin/davtest -url http://x.x.x.x

26 thoughts on “HTTP Enumeration”

  2. Attractive section of content. I just stumbled upon your weblog and in accession capital to assert that I acquire actually enjoyed account your blog posts. Any way I will be subscribing to your augment and even I achievement you access consistently quickly.

  5. Este site é realmente fabuloso. Sempre que acesso eu encontro coisas incríveis Você também vai querer acessar o nosso site e descobrir mais detalhes! conteúdo único. Venha descobrir mais agora! 🙂

  6. amei este site. Pra saber mais detalhes acesse nosso site e descubra mais. Todas as informações contidas são conteúdos relevantes e diferentes. Tudo que você precisa saber está ta lá.

  7. My brother recommended I might like this website. He was entirely right. This post actually made my day. You cann’t imagine just how much time I had spent for this info! Thanks!

  8. Your style is so unique compared to many other people. Thank you for publishing when you have the opportunity,Guess I will just make this bookmarked.2

  10. Wow that was strange. I just wrote an incredibly long comment but after I clicked submit my comment didn’t show up. Grrrr… well I’m not writing all that over again. Regardless, just wanted to say excellent blog!

  12. I do enjoy the manner in which you have framed this difficulty and it really does present me personally a lot of fodder for thought. On the other hand, through what precisely I have seen, I simply just wish when the actual feedback pack on that individuals stay on issue and don’t embark upon a soap box of some other news of the day. Still, thank you for this superb point and whilst I can not necessarily agree with it in totality, I value your point of view.

  19. Admiring the commitment you put into your website and detailed information you offer. It’s awesome to come across a blog every once in a while that isn’t the same out of date rehashed material. Excellent read! I’ve saved your site and I’m including your RSS feeds to my Google account.

  26. I’m curious to find out what blog system you happen to be using? I’m experiencing some small security issues with my latest site and I would like to find something more safeguarded. Do you have any solutions?

Leave a Reply

Your email address will not be published. Required fields are marked *