Skip to main content
For web applications, I run these initial checks: 
# Stack
curl -IL http://target.com

# Checking the HTML source code.
The Server header can sometimes provide the version of the web server. These versions aren’t common, but they are worth looking out for:
ServerVersion(s)Vulnerability
Apache2.4.49CVE-2021-41773 (Path Traversal/RCE)
Keep the web server in mind in case you get the ability to read local files.

​
Directory Fuzzing

feroxbuster --url http://app.com

feroxbuster --url http://app.com -w /path/to/wordlist

feroxbuster --url http://app.com -x php,html,bak,xml,txt
I run two wordlists: directory-list-2.3-medium.txt and common.txt from…? common.txt has hidden files so I get those out of the way before I use the former.

​
Subdomain/VHost Fuzzing

ffuf -u http://10.10.10.10 -w /path/to/wordlist:FUZZ -H 'HOST: FUZZ.domain.local'
For subdomains/vhosts, I use https://github.com/n0kovo/n0kovo_subdomains. There’s also an option with ffuf, -mc all, that will return all status codes. This is helpful for catching subdomains that hosts an API.

​
Parameter Fuzzing

todo