用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-info-04命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | wstg-info-04 |
| description | Enumerate Applications on Webserver |
| category | information-gathering |
| owasp_id | WSTG-INFO-04 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["recon","fingerprint","enumeration","wstg","info"] |
| tech_stack | [] |
| cwe_ids | ["CWE-200"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INFO-04
Enumerate Applications on Webserver
A single web server can host multiple web applications accessible through different URLs, ports, or virtual hosts. This test aims to comprehensively discover all web applications running on the target infrastructure. Missing applications during enumeration can result in overlooking critical vulnerabilities. Applications may be hidden at non-standard URL paths, running on unusual ports, or accessible only through specific hostnames (virtual hosting).
# Comprehensive TCP scan (all ports)
nmap -Pn -sT -sV -p0-65535 target.com
# Quick scan of common web ports
nmap -Pn -sV -p 80,443,8080,8443,8000,3000,4443,5000,9000,9443 target.com
nmap -sV --script=http-enum -p 80,443,8080,8443 target.com
nmap -sU -p 80,443,8080 target.com
# Fast full port scan
masscan -p0-65535 target.com --rate=1000
# Scan with banner grabbing
masscan -p0-65535 target.com --rate=1000 --banners
| Port | Common Service |
|---|---|
| 80 | HTTP |
| 443 | HTTPS |
| 8080 | HTTP Proxy/Tomcat |
| 8443 | HTTPS Alt |
| 8000 | Development servers |
| 3000 | Node.js/React |
| 4443 | HTTPS Alt |
| 5000 | Flask/Development |
| 9000 | PHP-FPM/SonarQube |
| 9443 | WSO2/VMware |
| 8888 | Jupyter/Alt HTTP |
| 8081 | HTTP Alt |
| 4000 | Development |
| 5001 | Development |
# Gobuster
gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt -t 50
# With extensions
gobuster dir -u https://target.com -w wordlist.txt -x php,asp,aspx,jsp,html -t 50
# ffuf
ffuf -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt
# Dirsearch
dirsearch -u https://target.com -e php,asp,aspx,jsp
# feroxbuster (recursive)
feroxbuster -u https://target.com -w wordlist.txt
# Check common paths manually
for path in admin administrator manager console portal api app webapp webmail mail owa cpanel phpmyadmin adminer jenkins gitlab sonar grafana kibana elastic; do
status=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com/$path")
echo "$path: $status"
done
/admin/
/administrator/
/manager/
/console/
/portal/
/api/
/api/v1/
/api/v2/
/app/
/webapp/
/webmail/
/mail/
/owa/
/cpanel/
/phpmyadmin/
/adminer/
/jenkins/
/gitlab/
/grafana/
/kibana/
/elastic/
/solr/
/sonar/
/nagios/
/zabbix/
/cacti/
/munin/
# Get nameservers
dig NS target.com
host -t ns target.com
nslookup -type=ns target.com
# Attempt zone transfer
dig axfr target.com @ns1.target.com
host -l target.com ns1.target.com
# Reverse DNS lookup
dig -x <target_ip>
host <target_ip>
# Amass
amass enum -d target.com
# Subfinder
subfinder -d target.com
# Assetfinder
assetfinder target.com
# DNSRecon
dnsrecon -d target.com -t std
# Sublist3r
sublist3r -d target.com
# crt.sh
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u
# Certspotter
curl -s "https://api.certspotter.com/v1/issuances?domain=target.com&include_subdomains=true" | jq '.[].dns_names[]'
# ffuf vhost discovery
ffuf -u https://target.com -H "Host: FUZZ.target.com" -w subdomains.txt -fs <filter_size>
# Gobuster vhost
gobuster vhost -u https://target.com -w subdomains.txt
# Virtual host scanner
python3 VHostScan.py -t target.com -w wordlist.txt
# Extract SAN from certificate
echo | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -noout -text | grep -A1 "Subject Alternative Name"
# Full certificate details
echo | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -noout -text
# Extract CN and SAN
openssl s_client -connect target.com:443 </dev/null 2>/dev/null | openssl x509 -noout -text | grep -E 'DNS:|Subject:'
# Multiple hosts
for host in target.com www.target.com api.target.com; do
echo "=== $host ==="
echo | openssl s_client -connect $host:443 -servername $host 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName
done
# Using online services (manual)
# - viewdns.info/reverseip/
# - bing.com (ip:x.x.x.x)
# - shodan.io
# Bing search for IP
# ip:93.184.216.34
# Shodan CLI
shodan host <target_ip>
# Google dorks
site:target.com
site:*.target.com
site:target.com inurl:admin
site:target.com inurl:login
# Bing
site:target.com
ip:<target_ip>
# Check each discovered host/port
for url in $(cat discovered_urls.txt); do
echo "=== $url ==="
curl -sI "$url" | head -10
done
# httpx for bulk verification
cat hosts.txt | httpx -title -status-code -tech-detect
# EyeWitness for screenshots
eyewitness --web -f urls.txt -d output/
| Tool | Description | Usage |
|---|---|---|
| Nmap | Network scanner | nmap -sV -p- target.com |
| Masscan | Fast port scanner | masscan -p0-65535 target.com |
| RustScan | Fast scanner + Nmap | rustscan -a target.com |
| Zmap | Internet-wide scanner | zmap -p 80 target.com/24 |
| Tool | Description | Usage |
|---|---|---|
| Gobuster | Directory brute-forcer | gobuster dir -u target.com -w wordlist.txt |
| ffuf | Fast web fuzzer | ffuf -u target.com/FUZZ -w wordlist.txt |
| Dirsearch | Directory scanner | dirsearch -u target.com |
| Feroxbuster | Recursive scanner | feroxbuster -u target.com |
| Dirb | Directory scanner | dirb https://target.com |
| Tool | Description | Usage |
|---|---|---|
| Amass | Subdomain enumeration | amass enum -d target.com |
| Subfinder | Subdomain discovery | subfinder -d target.com |
| DNSRecon | DNS enumeration | dnsrecon -d target.com |
| Sublist3r | Subdomain enumeration | sublist3r -d target.com |
| Assetfinder | Find domains | assetfinder target.com |
| Tool | Description | Usage |
|---|---|---|
| httpx | HTTP toolkit | cat hosts.txt | httpx |
| EyeWitness | Screenshot tool | eyewitness -f urls.txt |
| Aquatone | Screenshot tool | cat hosts.txt | aquatone |
| WhatWeb | Tech identifier | whatweb target.com |
| Service | URL | Purpose |
|---|---|---|
| Shodan | shodan.io | Host discovery |
| Censys | censys.io | Certificate search |
| crt.sh | crt.sh | CT logs |
| ViewDNS | viewdns.info | Reverse IP |
| SecurityTrails | securitytrails.com | DNS history |
#!/bin/bash
TARGET=$1
echo "=== APPLICATION ENUMERATION ==="
echo "Target: $TARGET"
echo ""
# 1. Port Scan
echo "[+] Port Scanning..."
nmap -sV -p 80,443,8080,8443,8000,3000,4443,5000,9000 $TARGET -oN nmap_web.txt
# 2. Subdomain Enumeration
echo "[+] Subdomain Enumeration..."
subfinder -d $TARGET -o subdomains.txt
amass enum -passive -d $TARGET >> subdomains.txt
sort -u subdomains.txt -o subdomains.txt
# 3. Certificate Analysis
echo "[+] Certificate Analysis..."
echo | openssl s_client -connect $TARGET:443 2>/dev/null | openssl x509 -noout -text | grep -E 'DNS:|Subject:' > cert_info.txt
# 4. DNS Zone Transfer Attempt
echo "[+] Zone Transfer Attempt..."
for ns in $(dig NS $TARGET +short); do
dig axfr $TARGET @$ns
done
# 5. Directory Brute-force
echo "[+] Directory Enumeration..."
gobuster dir -u https://$TARGET -w /usr/share/seclists/Discovery/Web-Content/common.txt -o dirs.txt -q
# 6. Virtual Host Discovery
echo "[+] Virtual Host Discovery..."
ffuf -u https://$TARGET -H "Host: FUZZ.$TARGET" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -o vhosts.txt -fs 0
# 7. Verify all discovered hosts
echo "[+] Verifying Hosts..."
cat subdomains.txt | httpx -silent -title -status-code -tech-detect -o live_hosts.txt
echo "[+] Enumeration Complete"
# Detect all HTTP services
nmap -sV -p- --script=http-title,http-server-header target.com
# Scan common web ports with NSE scripts
nmap -p 80,443,8080,8443 --script=http-enum,http-headers,http-methods target.com
# Identify web application technologies
nmap -p 80,443 --script=http-generator,http-php-version target.com
#!/bin/bash
IP=$1
DOMAIN=$2
WORDLIST=$3
while read subdomain; do
host="$subdomain.$DOMAIN"
response=$(curl -s -H "Host: $host" -o /dev/null -w "%{http_code}:%{size_download}" http://$IP)
code=$(echo $response | cut -d: -f1)
size=$(echo $response | cut -d: -f2)
echo "$host - Status: $code, Size: $size"
done < $WORDLIST
# Full discovery pipeline
cat domains.txt | amass enum -passive -df - | httpx -silent | aquatone -out screenshots/
# Example: Separate admin interfaces
- Public applications: DMZ segment
- Admin interfaces: Internal network only
- Development: Isolated segment
# Restrict zone transfers (BIND example)
zone "example.com" {
type master;
file "example.com.zone";
allow-transfer { none; };
# Or specific IPs only
allow-transfer { 192.168.1.2; };
};
# Apache - Disable default vhost response
<VirtualHost *:80>
ServerName default.invalid
Redirect 404 /
</VirtualHost>
# nginx - Default server block
server {
listen 80 default_server;
server_name _;
return 444;
}
Base Score: 5.3 (Medium)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
| Metric | Value | Description |
|---|---|---|
| Attack Vector | Network | Accessible via internet |
| Attack Complexity | Low | Standard enumeration techniques |
| Privileges Required | None | No authentication needed |
| User Interaction | None | No user interaction required |
| Scope | Unchanged | Impact scope unchanged |
| Confidentiality | Low | Application existence disclosure |
| Integrity | None | No integrity impact |
| Availability | None | No availability impact |
| Finding | Severity | Description |
|---|---|---|
| Public applications discovered | Info | Normal discovery |
| Admin interface on non-standard port | Low | Obscurity is not security |
| Unprotected admin interface | High | Direct administrative access |
| Development/staging exposed | Medium | Potentially vulnerable apps |
| Undocumented applications | Medium | Shadow IT risk |
| CWE ID | Title | Description |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information | Application enumeration disclosure |
| CWE-16 | Configuration | Improper server configuration |
| CWE-693 | Protection Mechanism Failure | Lack of access controls |
| CWE-284 | Improper Access Control | Insufficient access restrictions |
[ ] Full port scan completed (all 65535 ports)
[ ] Common web ports verified
[ ] Non-standard URL paths enumerated
[ ] Subdomain enumeration performed
[ ] DNS zone transfer attempted
[ ] Certificate transparency checked
[ ] SSL/TLS certificates analyzed for SANs
[ ] Virtual host brute-forcing completed
[ ] Reverse IP lookup performed
[ ] Search engine reconnaissance done
[ ] All discovered applications documented
[ ] Applications verified and accessible
[ ] Technologies identified per application
[ ] Screenshots captured (EyeWitness/Aquatone)
[ ] Risk assessment completed
[ ] Findings documented