hacktricks/network-services-pentesting/pentesting-web

80,443 - Pentesting Web Methodology

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!
• Get the official PEASS & HackTricks swag
• Discover The PEASS Family, our collection of exclusive NFTs
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @carlospolopm.
• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Bug bounty tip: sign up for Intigriti, a premium bug bounty platform created by hackers, for hackers! Join us at https://go.intigriti.com/hacktricks today, and start earning bounties up to $100,000!

{% embed url="https://go.intigriti.com/hacktricks" %}

Basic Info

The web service is the most common and extensive service and a lot of different types of vulnerabilities exists.

Default port: 80 (HTTP), 443(HTTPS)

PORT    STATE SERVICE
80/tcp  open  http
443/tcp open  ssl/https

nc -v domain.com 80 # GET / HTTP/1.0
openssl s_client -connect domain.com:443 # GET / HTTP/1.0

Web API Qap

{% content-ref url="web-api-pentesting.md" %} web-api-pentesting.md {% endcontent-ref %}

Methodology summary

jImejDaq jImejDaq 'e' vItlhutlh. 'ej, 'oH jImejDaq jImejDaq 'e' vItlhutlh. So, jImejDaq jImejDaq 'e' vItlhutlh, jImejDaq jImejDaq 'e' vItlhutlh, 'ej IP jImejDaq jImejDaq 'e' vItlhutlh.

• jImejDaq jImejDaq jImejDaq jImejDaq. jImejDaq jImejDaq jImejDaq jImejDaq 'ej jImejDaq jImejDaq jImejDaq jImejDaq.
• jImejDaq jImejDaq jImejDaq? jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq.
• jImejDaq jImejDaq jImejDaq? jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq.
• jImejDaq jImejDaq jImejDaq (vaj wpscan)?
• jImejDaq jImejDaq jImejDaq. jImejDaq jImejDaq jImejDaq jImejDaq 'ej jImejDaq jImejDaq jImejDaq jImejDaq.
• jImejDaq jImejDaq: robots, sitemap, 404 'ej SSL/TLS scan (HTTPS vaj).
• jImejDaq jImejDaq jImejDaq: jImejDaq jImejDaq jImejDaq, jImejDaq 'ej jImejDaq jImejDaq. jImejDaq jImejDaq jImejDaq.
• _jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jImejDaq jIm

whatweb -a 1 <URL> #Stealthy
whatweb -a 3 <URL> #Aggresive
webtech -u <URL>
webanalyze -host https://google.com -crawl 2

vulnerabilities of the web application version Search for

Check if any WAF

• https://github.com/EnableSecurity/wafw00f
• https://github.com/Ekultek/WhatWaf.git
• https://nmap.org/nsedoc/scripts/http-waf-detect.html

Web tech tricks

Some tricks for finding vulnerabilities in different well known technologies being used:

• AEM - Adobe Experience Cloud
• Apache
• Artifactory
• Buckets
• CGI
• Drupal
• Flask
• Git
• Golang
• GraphQL
• H2 - Java SQL database
• IIS tricks
• JBOSS
• Jenkins
• Jira
• Joomla
• JSP
• Laravel
• Moodle
• Nginx
• PHP (php has a lot of interesting tricks that could be exploited)
• Python
• Spring Actuators
• Symphony
• Tomcat
• VMWare
• Web API Pentesting
• WebDav
• Werkzeug
• Wordpress
• Electron Desktop (XSS to RCE)

Take into account that the same domain can be using different technologies in different ports, folders and subdomains.
If the web application is using any well known tech/platform listed before or any other, don't forget to search on the Internet new tricks (and let me know!).

Source Code Review

If the source code of the application is available in github, apart of performing by your own a White box test of the application there is some information that could be useful for the current Black-Box testing:

• Is there a Change-log or Readme or Version file or anything with version info accessible via web?
• How and where are saved the credentials? Is there any (accessible?) file with credentials (usernames or passwords)?
• Are passwords in plain text, encrypted or which hashing algorithm is used?
• Is it using any master key for encrypting something? Which algorithm is used?
• Can you access any of these files exploiting some vulnerability?
• Is there any interesting information in the github (solved and not solved) issues? Or in commit history (maybe some password introduced inside an old commit)?

{% content-ref url="code-review-tools.md" %} code-review-tools.md {% endcontent-ref %}

Automatic scanners

General purpose automatic scanners

nikto -h <URL>
whatweb -a 4 <URL>
wapiti -u <URL>
W3af
zaproxy #You can use an API
nuclei -ut && nuclei -target <URL>

# https://github.com/ignis-sec/puff (client side vulns fuzzer)
node puff.js -w ./wordlist-examples/xss.txt -u "http://www.xssgame.com/f/m4KKGHi2rVUN/?query=FUZZ"

CMS scanners

If a CMS is used don't forget to run a scanner, maybe something juicy is found:

Clusterd: JBoss, ColdFusion, WebLogic, Tomcat, Railo, Axis2, Glassfish
CMSScan: WordPress, Drupal, Joomla, vBulletin websites for Security issues. (GUI)
VulnX: Joomla, Wordpress, Drupal, PrestaShop, Opencart
CMSMap: (W)ordpress, (J)oomla, (D)rupal or (M)oodle
droopscan: Drupal, Joomla, Moodle, Silverstripe, Wordpress

cmsmap [-f W] -F -d <URL>
wpscan --force update -e --url <URL>
joomscan --ec -u <URL>
joomlavs.rb #https://github.com/rastating/joomlavs

ghItlhvam vaj web server ghaH ghItlhvam (data Dochvam) 'ej qaStaHvIS vaj web application ghItlhvam qar.

web application ghItlhvam Step-by-step

web application ghItlhvam ghaH qaStaHvIS ghItlhvam.

qaStaHvIS chegh

Default pages vaj qawHaq ghItlhvam:

• /robots.txt
• /sitemap.xml
• /crossdomain.xml
• /clientaccesspolicy.xml
• /.well-known/
• ghItlhvam 'ej qar ghItlhvam ghItlhvam ghItlhvam.

vaj 'e' ghItlhvam

web server qaStaHvIS ghItlhvam ghaH 'e' ghItlhvam ghItlhvam ghItlhvam ghItlhvam ghItlhvam ghItlhvam ghItlhvam.

• fake pages ghItlhvam /whatever_fake.php (.aspx,.html,.etc)
• "[]", "]]", 'ej "[[" ghItlhvam cookie values 'ej parameter values ghItlhvam ghItlhvam ghItlhvam ghItlhvam
• /~randomthing/%s URL 'ej input ghItlhvam ghItlhvam ghItlhvam ghItlhvam
• HTTP Verbs ghItlhvam PATCH, DEBUG ghItlhvam FAKE ghItlhvam

'e' upload files ghItlhvam (PUT verb, WebDav)**

WebDav ghItlhvam ghaH 'e' ghItlhvam 'ej root folder uploading files ghItlhvam ghItlhvam:

• Brute Force credentials ghItlhvam
• Upload files WebDav rest found folders web page ghItlhvam ghItlhvam ghItlhvam ghItlhvam

SSL/TLS vulnerabilites

• application 'e' HTTPS vaj ghItlhvam 'ej MitM vulnerability ghItlhvam
• application 'e' sensitive data (passwords) HTTP vaj ghItlhvam vulnerability ghItlhvam

testssl.sh ghItlhvam vulnerabilities (Bug Bounty programs vaj vulnerabilities) ghItlhvam a2sv ghItlhvam vulnerabilities recheck ghItlhvam:

./testssl.sh [--htmlfile] 10.10.10.10:443
#Use the --htmlfile to save the output inside an htmlfile also

# You can also use other tools, by testssl.sh at this momment is the best one (I think)
sslscan <host:port>
sslyze --regular <ip:port>

SSL/TLS vulnerabilities

• https://www.gracefulsecurity.com/tls-ssl-vulnerabilities/
• https://www.acunetix.com/blog/articles/tls-vulnerabilities-attacks-final-part/

Spidering

Qa'vIn spider web. Spider web paths find as much as possible. Web crawling external sources paths find as much as possible.

• gospider (go): HTML spider, LinkFinder JS files external sources (Archive.org, CommonCrawl.org, VirusTotal.com, AlienVault.com).
• hakrawler (go): HML spider, LinkFider JS files Archive.org external source.
• dirhunt (python): HTML spider, "juicy files" indicate.
• evine (go): Interactive CLI HTML spider. Archive.org search.
• meg (go): tool spider useful. indicate file hosts file paths meg fetch path host save response.
• urlgrab (go): HTML spider JS rendering capabilities. unmaintained, precompiled version old current code compile.
• gau (go): HTML spider external providers (wayback, otx, commoncrawl).
• ParamSpider: script find URLs parameter list.
• galer (go): HTML spider JS rendering capabilities.
• LinkFinder (python): HTML spider, JS beautify capabilities search paths JS files. look JSScanner wrapper LinkFinder.
• goLinkFinder (go): extract endpoints HTML source embedded javascript files. useful bug hunters, red teamers, infosec ninjas.
• JSParser (python2.7): python 2.7 script Tornado JSBeautifier parse relative URLs JavaScript files. easily discover AJAX requests. unmaintained.
• relative-url-extractor (ruby): file (HTML) extract URLs nifty regular expression find extract relative URLs ugly (minify) files.
• JSFScan (bash, several tools): Gather interesting information JS files several tools.
• subjs (go): Find JS files.
• page-fetch (go): Load page headless browser print urls load page.
• Feroxbuster (rust): Content discovery tool mixing options previous tools.
• Javascript Parsing: Burp extension find path params JS files.
• Sourcemapper: tool .js.map URL beatified JS code.
• xnLinkFinder: tool discover endpoints given target.
• waymore: Discover links wayback machine download responses wayback look links.
• HTTPLoot (go): Crawl (even filling forms) find sensitive info specific regexes.
• SpiderSuite: Spider Suite advance multi-feature GUI web security Crawler/Spider designed cyber security professionals.
• jsluice (go): Go package command-line tool extracting URLs, paths, secrets, interesting data JavaScript source code.
• ParaForge: ParaForge simple Burp Suite extension extract paramters endpoints request create custom wordlist fuzzing enumeration.

Brute Force directories and files

Brute-force root folder brute-force directories found method directories discovered Spidering (brute-forcing recursively appending beginning used wordlist names found directories).
Tools:

• Dirb / Dirbuster - Included Kali, old (slow) functional. Allow auto-signed certificates recursive search. Too slow compared th other options.
• Dirsearch (python)**: Allow auto-signed certificates recursive search.
• Gobuster (go): Allow auto-signed certificates, doesn't recursive search.
• Feroxbuster **- Fast, supports recursive search.
• wfuzz wfuzz -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt https://domain.com/api/FUZZ
• ffuf - Fast: ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://10.10.10.10/FUZZ
• uro (python): Spider tool given list found URLs delete "duplicated" URLs.
• Scavenger: Burp Extension create list directories burp history different pages.
• TrashCompactor: Remove URLs duplicated functionalities (based js imports).
• Chamaleon: Use wapalyzer detect used technologies select wordlists use.

Recommended dictionaries:

• https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/bf_directories.txt
• [Dirsearch included dictionary](
• https://github.com/google/fuzzing/tree/master/dictionaries
• https://github.com/six2dez/OneListForAll
• https://github.com/random-robbie/bruteforce-lists
• /usr/share/wordlists/dirb/common.txt
• /usr/share/wordlists/dirb/big.txt
• /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt

Note that anytime a new directory is discovered during brute-forcing or spidering, it should be Brute-Forced.

What to check on each file found

• Broken link checker: Find broken links inside HTMLs that may be prone to takeovers
• File Backups: Once you have found all the files, look for backups of all the executable files (".php", ".aspx"...). Common variations for naming a backup are: file.ext~, #file.ext#, ~file.ext, file.ext.bak, file.ext.tmp, file.ext.old, file.bak, file.tmp and file.old. You can also use the tool bfac or backup-gen.
• Discover new parameters: You can use tools like Arjun, parameth, x8 and Param Miner to discover hidden parameters. If you can, you could try to search hidden parameters on each executable web file.
• Arjun all default wordlists: https://github.com/s0md3v/Arjun/tree/master/arjun/db
• Param-miner “params” : https://github.com/PortSwigger/param-miner/blob/master/resources/params
• Assetnote “parameters_top_1m”: https://wordlists.assetnote.io/
• nullenc0de “params.txt”: https://gist.github.com/nullenc0de/9cb36260207924f8e1787279a05eb773
• Comments: Check the comments of all the files, you can find credentials or hidden functionality.
• If you are playing CTF, a "common" trick is to hide information inside comments at the right of the page (using hundreds of spaces so you don't see the data if you open the source code with the browser). Other possibility is to use several new lines and hide information in a comment at the bottom of the web page.
• API keys: If you find any API key there is guide that indicates how to use API keys of different platforms: keyhacks, zile, truffleHog, SecretFinder, RegHex, DumpsterDive, EarlyBird
• Google API keys: If you find any API key looking like AIzaSyA-qLheq6xjDiEIRisP_ujUseYLQCHUjik you can use the project gmapapiscanner to check which apis the key can access.
• S3 Buckets: While spidering look if any subdomain or any link is related with some S3 bucket. In that case, check the permissions of the bucket.

Special findings

While performing the spidering and brute-forcing you could find interesting things that you have to notice.

Interesting files

• Look for links to other files inside the CSS files.
• If you find a .git file some information can be extracted
• If you find a .env information such as api keys, dbs passwords and other information can be found.
• If you find API endpoints you should also test them. These aren't files, but will probably "look like" them.
• JS files: In the spidering section several tools that can extract path from JS files were mentioned. Also, It would be interesting to monitor each JS file found, as in some ocations, a change may indicate that a potential vulnerability was introduced in the code. You could use for example JSMon.
• You should also check discovered JS files with RetireJS or JSHole to find if it's vulnerable.
• Javascript Deobfuscator and Unpacker: https://lelinhtinh.github.io/de4js/, https://www.dcode.fr/javascript-unobfuscator
• Javascript Beautifier: http://jsbeautifier.org/, http://jsnice.org/
• JsFuck deobfuscation (javascript with chars:"[]!+" https://ooze.ninja/javascript/poisonjs/)
• TrainFuck: +72.+29.+7..+3.-67.-12.+55.+24.+3.-6.-8.-67.-23.
• In several occasions you will need to understand regular expressions used, this will be useful: https://regex101.com/
• You could also monitor the files were forms were detected, as a change in the parameter or the apearance f a new form may indicate a potential new vulnerable functionality.

403 Forbidden/Basic Authentication/401 Unauthorized (bypass)

{% content-ref url="403-and-401-bypasses.md" %} 403-and-401-bypasses.md {% endcontent-ref %}

502 Proxy Error

If any page responds with that code, it's probably a bad configured proxy. If you send a HTTP request like: GET https://google.com HTTP/1.1 (with the host header and other common headers), the proxy will try to access google.com and you will have found a SSRF.

NTLM Authentication - Info disclosure

If the running server asking for authentication is Windows or you find a login asking for your credentials (and asking for domain name), you can provoke an information disclosure.
Send the header: “Authorization: NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=” and due to how the NTLM authentication works, the server will respond with internal info (IIS version, Windows version...) inside the header "WWW-Authenticate".
You can automate this using the nmap plugin "http-ntlm-info.nse".

HTTP Redirect (CTF)

It is possible to put content inside a Redirection. This content won't be shown to the user (as the browser will execute the redirection) but something could be hidden in there.

Web Vulnerabilities Checking

Now that a comprehensive enumeration of the web application has been performed it's time to check for a lot of possible vulnerabilities. You can find the checklist here:

{% content-ref url="../../pentesting-web/web-vulnerabilities-methodology/" %} web-vulnerabilities-methodology {% endcontent-ref %}

Find more info about web vulns in:

• https://six2dez.gitbook.io/pentest-book/others/web-checklist
• https://kennel209.gitbooks.io/owasp-testing-guide-v4/content/en/web_application_security_testing/configuration_and_deployment_management_testing.html
• https://owasp-skf.gitbook.io/asvs-write-ups/kbid-111-client-side-template-injection

Monitor Pages for changes

You can use tools such as https://github.com/dgtlmoon/changedetection.io to monitor pages for modifications that might insert vulnerabilities.

HackTricks Automatic Commands

Protocol_Name: Web    #Protocol Abbreviation if there is one.
Port_Number:  80,443     #Comma separated if there is more than one.
Protocol_Description: Web         #Protocol Abbreviation Spelled out

Entry_1:
Name: Notes
Description: Notes for Web
Note: |
https://book.hacktricks.xyz/pentesting/pentesting-web

Entry_2:
Name: Quick Web Scan
Description: Nikto and GoBuster
Command: nikto -host {Web_Proto}://{IP}:{Web_Port} &&&& gobuster dir -w {Small_Dirlist} -u {Web_Proto}://{IP}:{Web_Port} && gobuster dir -w {Big_Dirlist} -u {Web_Proto}://{IP}:{Web_Port}

Entry_3:
Name: Nikto
Description: Basic Site Info via Nikto
Command: nikto -host {Web_Proto}://{IP}:{Web_Port}

Entry_4:
Name: WhatWeb
Description: General purpose auto scanner
Command: whatweb -a 4 {IP}

Entry_5:
Name: Directory Brute Force Non-Recursive
Description:  Non-Recursive Directory Brute Force
Command: gobuster dir -w {Big_Dirlist} -u {Web_Proto}://{IP}:{Web_Port}

Entry_6:
Name: Directory Brute Force Recursive
Description: Recursive Directory Brute Force
Command: python3 {Tool_Dir}dirsearch/dirsearch.py -w {Small_Dirlist} -e php,exe,sh,py,html,pl -f -t 20 -u {Web_Proto}://{IP}:{Web_Port} -r 10

Entry_7:
Name: Directory Brute Force CGI
Description: Common Gateway Interface Brute Force
Command: gobuster dir -u {Web_Proto}://{IP}:{Web_Port}/ -w /usr/share/seclists/Discovery/Web-Content/CGIs.txt -s 200

Entry_8:
Name: Nmap Web Vuln Scan
Description: Tailored Nmap Scan for web Vulnerabilities
Command: nmap -vv --reason -Pn -sV -p {Web_Port} --script=`banner,(http* or ssl*) and not (brute or broadcast or dos or external or http-slowloris* or fuzzer)` {IP}

Entry_9:
Name: Drupal
Description: Drupal Enumeration Notes
Note: |
git clone https://github.com/immunIT/drupwn.git for low hanging fruit and git clone https://github.com/droope/droopescan.git for deeper enumeration

Entry_10:
Name: WordPress
Description: WordPress Enumeration with WPScan
Command: |
?What is the location of the wp-login.php? Example: /Yeet/cannon/wp-login.php
wpscan --url {Web_Proto}://{IP}{1} --enumerate ap,at,cb,dbe && wpscan --url {Web_Proto}://{IP}{1} --enumerate u,tt,t,vp --passwords {Big_Passwordlist} -e

Entry_11:
Name: WordPress Hydra Brute Force
Description: Need User (admin is default)
Command: hydra -l admin -P {Big_Passwordlist} {IP} -V http-form-post '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location'

Entry_12:
Name: Ffuf Vhost
Description: Simple Scan with Ffuf for discovering additional vhosts
Command: ffuf -w {Subdomain_List}:FUZZ -u {Web_Proto}://{Domain_Name} -H "Host:FUZZ.{Domain_Name}" -c -mc all {Ffuf_Filters}

Bug bounty tip: Intigriti qIb bug bounty platform created by hackers, for hackers! https://go.intigriti.com/hacktricks join qaStaHvIS, $100,000 bounties earn start!

{% embed url="https://go.intigriti.com/hacktricks" %}

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!
• Get the official PEASS & HackTricks swag
• Discover The PEASS Family, our collection of exclusive NFTs
• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @carlospolopm.
• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.