Web Application Enumeration
Reference: https://owasp.org/www-project-top-ten/
Phase I — Enumeration
1. Technology Fingerprinting
Identify technologies running on the target:
- Wappalyzer browser extension (if site is internet-facing): https://www.wappalyzer.com/
- whatweb:
whatweb $TARGET
2. Nmap Service Scan
sudo nmap -p 80 -sV $TARGET
3. Nmap HTTP Scripts
sudo nmap -p 80 --script=http-enum $TARGET
4. Directory Discovery
Always brute force with the file extensions relevant to the stack (-x), and use -k to skip TLS verification on HTTPS:
gobuster dir -u http://$TARGET -w /usr/share/wordlists/dirb/common.txt -x php,txt,html,bak
feroxbuster -u http://$TARGET -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,txt -r
ffuf -u http://$TARGET/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -e .php,.txt
feroxbuster recurses automatically (-r follows redirects); ffuf is the fastest and drives the fuzzing patterns below.
On engagements, use multiple wordlists and run them in the background. Decrease thread count with -t 5 to reduce traffic if needed.
Useful wordlists:
/usr/share/wordlists/dirb/common.txt/usr/share/wordlists/dirb/big.txt/usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt/usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
5. Common Files to Check
Always request these directly — they leak structure, tech, and sometimes credentials:
curl -s http://$TARGET/robots.txt
curl -s http://$TARGET/sitemap.xml
curl -s http://$TARGET/.git/HEAD # exposed git repo → dump with git-dumper
curl -s http://$TARGET/.env # framework secrets
curl -s http://$TARGET/security.txt
6. Parameter & Virtual Host Fuzzing
Discover hidden GET parameters:
ffuf -u "http://$TARGET/index.php?FUZZ=1" -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fs <baseline-size>
Discover virtual hosts (name-based sites behind the same IP):
ffuf -u http://$TARGET -H "Host: FUZZ.$DOMAIN" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs <baseline-size>
-fs <baseline-size> filters out the default-response size so only real hits show. Use arjun as a dedicated parameter finder if ffuf is noisy.
7. Manual Inspection
- Inspect the entire page source
- Right-click → Inspect input fields
- Beautify code by clicking
{ }in bottom left in Firefox dev tools - Check all links and buttons
- Navigate to all accessible pages
Tools
| Tool | Purpose |
|---|---|
| GoBuster | Directory and file brute forcing |
| wfuzz | Web fuzzing (parameters, directories, etc.) |
| Burp Suite | HTTP proxy, request manipulation, repeater |
| Nikto | Web server vulnerability scanner |
| CeWL | Custom wordlist generator from target website |
| wpscan | WordPress-specific scanner |
Common invocations:
nikto -h http://$TARGET
wpscan --url http://$TARGET --enumerate ap,at,cb,dbe # plugins, themes, config backups, users
wpscan --url http://$TARGET --passwords rockyou.txt --usernames admin
cewl -d 2 -m 5 -w wordlist.txt http://$TARGET # scrape a custom wordlist from the site
WordPress plugin/theme enumeration and login brute forcing require an API token for vulnerability data — register free at wpscan.com and pass --api-token.