Web App Fingerprinting

#Httpie (<https://httpie.io/>)
http <http://website>

#WhatWeb (<https://github.com/urbanadventurer/WhatWeb>)
whatweb <http://website>

#web browser tools
wappalyser / mod_header extensions

#urlscan.io
[<https://urlscan.io/>](<https://urlscan.io/>)

MSF - Web Enumeration

auxiliary/scanner/http/apache_userdir_enum
auxiliary/scanner/http/brute_dirs
auxiliary/scanner/http/dir_scanner
auxiliary/scanner/http/dir_listing
auxiliary/scanner/http/http_put
auxiliary/scanner/http/files_dir
auxiliary/scanner/http/http_login
auxiliary/scanner/http/http_header
auxiliary/scanner/http/http_version
auxiliary/scanner/http/robots_txt

URL discovery

Gobuster (Directory discovery)

gobuster dir -u <http://192.156.207.3> -w /usr/share/wordlists/dirb/common.txt -b
403,404 #exclude 403/404 responses

gobuster dir -u <http://10.10.232.151> -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt -x php,html,txt,htm,log # add file search

gobuster dir -u <https://example.com> -w /wordlists/Discovery/Web-Content/big.txt -t 4 --delay 1s 

• NB: chercher des fichier => ajouter–x php,txt,html
• NB2: relancer gobuster sur les répertoires trouvés à la racine (pour récursivité !)
• Pour trouver les sous domaines utiliser vhost ou dns:

Gobuster DNS (DNS enumeration)

$ gobuster dns -q -r 8.8.8.8 -d example.com -w wordlists/Discovery/DNS/subdomains-top1million-5000.txt -t 4 --delay 1s -o results.txt"

Gobuster vhost (sous domaine sur un même host)

gobuster vhost -u <https://example.com> -t 50 -w /wordlists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain

• NB: ne pas oublier le —append-domain pour faire sousdomaine.domaine.tld !!!

Gobuster : Le bruteforce de pages web – Kali-linux.fr