Web Enumeration

---
name: Web Application Enumeration
description: |
  This skill should be used when the user asks about "gobuster", "directory fuzzing",
  "web enumeration", "nikto", "web vulnerabilities", "feroxbuster", "ffuf",
  "subdomain enumeration", or needs guidance on web application testing.
version: 1.0.0
---

# Web Application Enumeration Skill

## Overview
Techniques for discovering web content, identifying technologies, and finding vulnerabilities in web applications.

## Technology Fingerprinting

### Whatweb
```bash
# Basic scan
whatweb http://<TARGET>

# Aggressive scan
whatweb -a 3 http://<TARGET>

# Verbose output
whatweb -v http://<TARGET>
```

### Manual Header Analysis
```bash
# Check response headers
curl -I http://<TARGET>

# Key headers to note:
# Server: Apache/2.4.41
# X-Powered-By: PHP/7.4
# X-AspNet-Version: 4.0.30319
```

### Wappalyzer (Browser Extension)
- Identifies CMS, frameworks, libraries
- Shows JavaScript libraries
- Detects analytics and marketing tools

## Directory Fuzzing

### Gobuster
```bash
# Basic directory scan
gobuster dir -u http://<TARGET> -w /usr/share/wordlists/dirb/common.txt

# With extensions
gobuster dir -u http://<TARGET> -w /usr/share/wordlists/dirb/common.txt \
    -x php,html,txt,bak,zip

# With authentication
gobuster dir -u http://<TARGET> -w wordlist.txt \
    -U admin -P password

# Ignore SSL errors
gobuster dir -u https://<TARGET> -w wordlist.txt -k
```

### Feroxbuster (Recursive)
```bash
# Basic recursive scan
feroxbuster -u http://<TARGET> -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

# With extensions and depth
feroxbuster -u http://<TARGET> \
    -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
    -x php,html,txt -d 3

# Quiet mode with output
feroxbuster -u http://<TARGET> -w wordlist.txt -q -o results.txt
```

### FFUF (Fast Fuzzer)
```bash
# Directory fuzzing
ffuf -u http://<TARGET>/FUZZ -w wordlist.txt

# With extensions
ffuf -u http://<TARGET>/FUZZ -w wordlist.txt -e .php,.html,.txt

# Virtual host fuzzing
ffuf -u http://<TARGET> -H "Host: FUZZ.<DOMAIN>" \
    -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
    -fs <size_to_filter>

# POST parameter fuzzing
ffuf -u http://<TARGET>/login -X POST \
    -d "username=admin&password=FUZZ" -w passwords.txt
```

## Subdomain Enumeration

### DNS-Based
```bash
# Gobuster DNS mode
gobuster dns -d <DOMAIN> -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Amass
amass enum -passive -d <DOMAIN>
```

### Virtual Host Fuzzing
```bash
# Gobuster vhost mode
gobuster vhost -u http://<TARGET> \
    -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Add to /etc/hosts if found
echo "<IP> subdomain.domain.com" >> /etc/hosts
```

## Vulnerability Scanning

### Nikto
```bash
# Basic scan
nikto -h http://<TARGET>

# With output
nikto -h http://<TARGET> -o nikto.txt

# Scan specific port
nikto -h http://<TARGET>:8080

# With authentication
nikto -h http://<TARGET> -id admin:password
```

### Nuclei
```bash
# All templates
nuclei -u http://<TARGET>

# CVE templates only
nuclei -u http://<TARGET> -t cves/

# Specific severity
nuclei -u http://<TARGET> -severity critical,high
```

## Common Files to Check

### Information Disclosure
```bash
curl http://<TARGET>/robots.txt
curl http://<TARGET>/sitemap.xml
curl http://<TARGET>/.git/HEAD
curl http://<TARGET>/.svn/entries
curl http://<TARGET>/.htaccess
curl http://<TARGET>/crossdomain.xml
curl http://<TARGET>/clientaccesspolicy.xml
```

### Configuration Files
```bash
curl http://<TARGET>/web.config
curl http://<TARGET>/wp-config.php.bak
curl http://<TARGET>/config.php.bak
curl http://<TARGET>/.env
curl http://<TARGET>/phpinfo.php
```

### Backup Files
```bash
# Common backup extensions
for ext in bak old orig backup ~; do
    curl -s -o /dev/null -w "%{http_code}" http://<TARGET>/index.php.$ext
done
```

## CMS-Specific Enumeration

### WordPress
```bash
# WPScan
wpscan --url http://<TARGET> -e vp,vt,u

# With API token (more results)
wpscan --url http://<TARGET> --api-token <TOKEN> -e ap,at,u

# Brute force
wpscan --url http://<TARGET> -U admin -P /usr/share/wordlists/rockyou.txt
```

### Joomla
```bash
# Joomscan
joomscan -u http://<TARGET>
```

### Drupal
```bash
# Droopescan
droopescan scan drupal -u http://<TARGET>
```

## Parameter Discovery

### Arjun
```bash
# Find hidden parameters
arjun -u http://<TARGET>/page

# With wordlist
arjun -u http://<TARGET>/page -w params.txt
```

### Manual Testing
```bash
# Common parameter names
# id, page, file, path, dir, search, q, query, url, redirect
# user, username, pass, password, email, token, key, api
```

## Wordlists Reference

| Purpose | Wordlist |
|---------|----------|
| Directories | /usr/share/wordlists/dirb/common.txt |
| Directories (larger) | /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt |
| Files | /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt |
| Subdomains | /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt |
| Parameters | /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt |

## Output Format

```markdown
# Web Enumeration: <TARGET>

## Technologies
| Component | Value |
|-----------|-------|
| Server | Apache 2.4.41 |
| Language | PHP 7.4 |
| CMS | WordPress 5.8 |

## Directories Found
| Path | Status | Size | Notes |
|------|--------|------|-------|
| /admin | 302 | - | Redirects to login |
| /backup | 200 | 4521 | Directory listing |
| /uploads | 403 | - | Forbidden |

## Files of Interest
- /robots.txt - Disallows /admin, /backup
- /.git/HEAD - Git repository exposed
- /wp-config.php.bak - Backup config file

## Vulnerabilities
- [ ] Directory listing enabled
- [ ] Git repository exposed
- [ ] Backup files accessible
```