web-application-enumeration

name	Web Application Enumeration
description	This skill should be used when the user asks about "gobuster", "directory fuzzing", "web enumeration", "nikto", "web vulnerabilities", "feroxbuster", "ffuf", "subdomain enumeration", or needs guidance on web application testing.
version	1.0.0

Web Application Enumeration Skill

Overview

Techniques for discovering web content, identifying technologies, and finding vulnerabilities in web applications.

Technology Fingerprinting

Whatweb

# Basic scan
whatweb http://<TARGET>

# Aggressive scan
whatweb -a 3 http://<TARGET>

# Verbose output
whatweb -v http://<TARGET>

Manual Header Analysis

# Check response headers
curl -I http://<TARGET>

# Key headers to note:
# Server: Apache/2.4.41
# X-Powered-By: PHP/7.4
# X-AspNet-Version: 4.0.30319

Wappalyzer (Browser Extension)

• Identifies CMS, frameworks, libraries
• Shows JavaScript libraries
• Detects analytics and marketing tools

Directory Fuzzing

Gobuster

# Basic directory scan
gobuster dir -u http://<TARGET> -w /usr/share/wordlists/dirb/common.txt

# With extensions
gobuster dir -u http://<TARGET> -w /usr/share/wordlists/dirb/common.txt \
    -x php,html,txt,bak,zip

# With authentication
gobuster dir -u http://<TARGET> -w wordlist.txt \
    -U admin -P password

# Ignore SSL errors
gobuster dir -u https://<TARGET> -w wordlist.txt -k

Feroxbuster (Recursive)

# Basic recursive scan
feroxbuster -u http://<TARGET> -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

# With extensions and depth
feroxbuster -u http://<TARGET> \
    -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
    -x php,html,txt -d 3

# Quiet mode with output
feroxbuster -u http://<TARGET> -w wordlist.txt -q -o results.txt

FFUF (Fast Fuzzer)

# Directory fuzzing
ffuf -u http://<TARGET>/FUZZ -w wordlist.txt

# With extensions
ffuf -u http://<TARGET>/FUZZ -w wordlist.txt -e .php,.html,.txt

# Virtual host fuzzing
ffuf -u http://<TARGET> -H "Host: FUZZ.<DOMAIN>" \
    -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
    -fs <size_to_filter>

# POST parameter fuzzing
ffuf -u http://<TARGET>/login -X POST \
    -d "username=admin&password=FUZZ" -w passwords.txt

Subdomain Enumeration

DNS-Based

# Gobuster DNS mode
gobuster dns -d <DOMAIN> -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Amass
amass enum -passive -d <DOMAIN>

Virtual Host Fuzzing

# Gobuster vhost mode
gobuster vhost -u http://<TARGET> \
    -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Add to /etc/hosts if found
echo "<IP> subdomain.domain.com" >> /etc/hosts

Vulnerability Scanning

Nikto

# Basic scan
nikto -h http://<TARGET>

# With output
nikto -h http://<TARGET> -o nikto.txt

# Scan specific port
nikto -h http://<TARGET>:8080

# With authentication
nikto -h http://<TARGET> -id admin:password

Nuclei

# All templates
nuclei -u http://<TARGET>

# CVE templates only
nuclei -u http://<TARGET> -t cves/

# Specific severity
nuclei -u http://<TARGET> -severity critical,high

Common Files to Check

Information Disclosure

curl http://<TARGET>/robots.txt
curl http://<TARGET>/sitemap.xml
curl http://<TARGET>/.git/HEAD
curl http://<TARGET>/.svn/entries
curl http://<TARGET>/.htaccess
curl http://<TARGET>/crossdomain.xml
curl http://<TARGET>/clientaccesspolicy.xml

Configuration Files

curl http://<TARGET>/web.config
curl http://<TARGET>/wp-config.php.bak
curl http://<TARGET>/config.php.bak
curl http://<TARGET>/.env
curl http://<TARGET>/phpinfo.php

Backup Files

# Common backup extensions
for ext in bak old orig backup ~; do
    curl -s -o /dev/null -w "%{http_code}" http://<TARGET>/index.php.$ext
done

CMS-Specific Enumeration

WordPress

# WPScan
wpscan --url http://<TARGET> -e vp,vt,u

# With API token (more results)
wpscan --url http://<TARGET> --api-token <TOKEN> -e ap,at,u

# Brute force
wpscan --url http://<TARGET> -U admin -P /usr/share/wordlists/rockyou.txt

Joomla

# Joomscan
joomscan -u http://<TARGET>

Drupal

# Droopescan
droopescan scan drupal -u http://<TARGET>

Parameter Discovery

Arjun

# Find hidden parameters
arjun -u http://<TARGET>/page

# With wordlist
arjun -u http://<TARGET>/page -w params.txt

Manual Testing

# Common parameter names
# id, page, file, path, dir, search, q, query, url, redirect
# user, username, pass, password, email, token, key, api

Wordlists Reference

Purpose	Wordlist
Directories	/usr/share/wordlists/dirb/common.txt
Directories (larger)	/usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
Files	/usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt
Subdomains	/usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
Parameters	/usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt

Output Format

# Web Enumeration: <TARGET>

## Technologies
| Component | Value |
|-----------|-------|
| Server | Apache 2.4.41 |
| Language | PHP 7.4 |
| CMS | WordPress 5.8 |

## Directories Found
| Path | Status | Size | Notes |
|------|--------|------|-------|
| /admin | 302 | - | Redirects to login |
| /backup | 200 | 4521 | Directory listing |
| /uploads | 403 | - | Forbidden |

## Files of Interest
- /robots.txt - Disallows /admin, /backup
- /.git/HEAD - Git repository exposed
- /wp-config.php.bak - Backup config file

## Vulnerabilities
- [ ] Directory listing enabled
- [ ] Git repository exposed
- [ ] Backup files accessible