Enumeration

Mandatory

1. Start Burp
2. Start ./script/web-enum.sh
3. Browse through the page (with Burp) 
   1. Check robots.txt
   2. Check a 404 page (site /dsoidfsiohfdghfdghfgdiofdiogidgffg)
4. Deter­mine and write down each used technology: 
   1. Serv­er
   2. Appli­ca­tion Server
   3. Lan­guages
   4. Frame­works
5. For all of the pre­vi­ous findings: 
   1. Check if there is a blog post here
   2. Check for exploits.
   3. Check for web tech tricks on Hacktricks
   4. Try a spe­cial­ized scanner
   5. Down­load the exact ver­sion of the CMS and look for inter­est­ing files.
6. Repeat web crawl­ing for all found directories.

Optional

• Check for sequen­tial URLs and try to enu­mer­ate oth­er URLs.
• If there are para­me­ters, try change them (maybe also with a small script and a wordlist with usu­al com­mand parameters) 
  • See ParamSpi­der
• Try oth­er wordlists
• Try wordlists with oth­er suffixes
• Try oth­er crawlers (dirb / dir­buster / nikto / …)
• Find exploits for the server
• Check if exter­nal sources are embe­d­ed (e.g. via a para­me­ter / LFI)
• Make a wordlist with cewl
• Ana­lyze the cookies
• Ana­lyze the local storage
• If you have a domain: 
  1. Try vhost enumeration
• For logins / htauth: 
  1. Search for default passwords
  2. Typ ’ or ” or — to trig­ger a pos­si­ble SQL injection.
  3. Try usu­al combinations: 
     • admin / admin
     • admin / password
     • guest / guest
     • test / test
     • admin / 123456
  4. Brute-force with cewl-based wordlist
  5. Brute-force with gen­er­al wordlists
  6. Set anoth­er Host header
  7. Set proxy header
  8. Try oth­er tips from the Hack­tricks list
• Per­form a gen­er­al vul­ner­a­bil­i­ty scan: 
  1. Nmap NSE
  2. Metas­ploit exploit_suggester
  3. Open­VAS
  4. Nes­sus
• For forms:
  1. Make a pseu­do-nor­mal request which is record­ed in Burp
  2. Per­form requests with the following: 
     1. ’
     2. ”
     3. Extrem long input data
     4. Escap­ing char­ac­ters for the used tech­nol­o­gy (e.g. <% %> {{ }} …)
  3. Store the request in a file and exe­cute sqlmap -v 4 -r /tmp/request.
• For file uploads: 
  • See file upload tricks.
• You have many text to look through / parse? See the grepable strings page.

Tools

• Nik­to
• dirb
• dir­buster
• unis­can
• OWASP ZAP
• Blind­Ele­phant
• WhatWeb
• com­mix (SQL injections)
• wp_scan (Word­Press)
• jom­scan (Joom­la)
• droopes­can (Dru­pal, Silverstripe)
• sslyze (SSL scan)
• Cadav­er (for CalDAV/CardDAV client software)
• Pata­tor (brute force)
• magscan (Magen­to)