# Website Enumeration ## Resources When enumerating websites, check the following resources as a starting point * Components of the website, like blog frameworks, shops * `robots.txt` and `sitemap.xml` * [Favicon](https://wiki.owasp.org/index.php/OWASP_favicon_database) of the site * Headers, `curl ` including `-I` and `-v` parameters * Use Wappalyzer or whatweb to list an overview of the site's components * Snapshots of the site via waybackmachine * Check git respositories of the site ## Web Enumeration in Practice ### Fuzz Faster U Fool Directory fuzzing via ffuf ```sh ffuf -u http:///FUZZ -w /usr/share/seclists/Discovery/Web-Content/big.txt ffuf -u http:///FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt ``` Enumerate directories of the website regardless of HTTP status ```sh ffuf -c -w /usr/share/seclists/Discovery/Web-Content/common.txt -u http://$IP/FUZZ -fs 0 -mc all ``` Fuzz with other HTTP methods like POST ```sh ffuf -c -w /usr/share/seclists/Discovery/Web-Content/big.txt -u http://$IP/FUZZ -fs $SIZE -mc all -C POST ``` File fuzzing via ffuf ```sh ffuf -u http:///FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words-lowercase.txt -e .php,.txt ``` #### Fuzz URL parameters ```sh ffuf -u 'http://MACHINE_IP/sqli-labs/Less-1/?FUZZ=1' -c -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fw 39 ffuf -u 'http://MACHINE_IP/sqli-labs/Less-1/?FUZZ=1' -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words-lowercase.txt -fw 39 ``` Fuzz values of parameters ```sh seq 0 255 | fuff -u 'http:///sqli-labs/Less-1/?id=FUZZ -c -w - -fw 33 ``` Fuzz HTTP POST values in the following way ```sh ffuf -u http:// -c -w /usr/share/seclists/Passwords/Leaked-Databases/hak5.txt -X POST -d 'uname=Dummy&passwd=FUZZ&submit=Submit' -fs 1435 -H 'Content-Type: application/x-www-form-urlencoded' ``` #### Fuzz Users and Use Bruteforce Fuzz users and write the results to a file as output ```sh ffuf -w /usr/share/seclists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u http:///customers/signup -mr "username already exists" -o fuff.out ``` Use the output users saved in `fuff.out` to bruteforce ```sh ffuf -w userlist.txt:W1,/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http:///customers/login -fc 200 ``` #### Fuzz Subdomains ```sh ffuf -u http://FUZZ.test.com -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt ``` or if the subdomains are listed in the target's host file ```sh ffuf -w /usr/share/seclists/Discovery/DNS/namelist.txt -H "Host: FUZZ.test.com" -u http:// -fs 0 ``` * Fuzz Vhosts & Server Blocks ```sh ffuf -u http://FUZZ.test.com -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs 0 ffuf -u http://test.com -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -H 'Host: FUZZ.test.com' -fs 0 ``` #### Proxy * `-replay-proxy ` or `-x ` #### FUZZ Saved Request A stored request can be fuzzed using ffuf, remember to set the parameter value you want to fuzz to `FUZZ` inside the file. ```sh ffuf -request req.txt -w pin.txt -fs 89 -t 70 > output ``` ### Gobuster [Repo](https://github.com/OJ/gobuster.git) #### Enumerate Directories via Gobuster ```sh gobuster dir -u -w ``` #### Enumerate DNS via Gobuster ```sh gobuster dns -d -w --show-cname --show-ips --resolver ``` #### Enumerate Vhosts via Gobuster Find other Domains on a host via `seclists/Discovery/DNS/subdomains-top1million-5000.txt` ```sh gobuster vhost -u -w ``` #### FileExtension Fuzz for specific file extensions ```sh gobuster dir -u -w /usr/share/seclists/Discovery/raft-small-word-lowercase.txt -x .conf,.js ``` #### Basic Auth ```sh gobuster help dir ``` * `--username` and `--password` * `dir -s` Accept HTTP Status * `dir -k` Skip TLS Auth * `dir -a` User Agent #### Wordlists ```sh /usr/share/seclists/Discovery/Web-Content/common.txt /usr/share/seclists/Discovery/Web-Content/big.txt /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt /usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt ``` ### Wfuzz #### Enumerate directories via Wfuzz Fuzz directories with wfuzz ```sh wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -u $ATTACKER_IP/FUZZ -t 100 --hh 0 ``` POST requests fuzzing with wfuzz ```sh wfuzz -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -u $ATTACKER_IP/FUZZ -t 100 --hh 0 -X POST ``` #### Parameters with Wfuzz Fuzz parameters ```sh wfuzz -c -z file,/usr/share/seclists/Discovery/Web-Content/common.txt -X POST --hh 45 -u http:///api/items\?FUZZ\=test ``` #### DNS with Wfuzz ```sh wfuzz -H "Host: FUZZ.example.com" --hc 302,400 -t 50 -c -z file,"/usr/share/seclists/Discovery/Web-Content/namelist.txt" http://example.com ```