> ## Documentation Index
> Fetch the complete documentation index at: https://notes.chairwoman.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# 80 - HTTP

For web applications, I run these initial checks:

```shellscript theme={null}
# Stack
curl -IL http://target.com

# Checking the HTML source code.
```

The `Server` header can sometimes provide the version of the web server. These versions aren't common, but they are worth looking out for:

| Server | Version(s) | Vulnerability                       |
| ------ | ---------- | ----------------------------------- |
| Apache | 2.4.49     | CVE-2021-41773 (Path Traversal/RCE) |

Keep the web server in mind in case you get the ability to read local files.

# Directory Fuzzing

<Tabs>
  <Tab title="feroxbuster">
    ```shellscript theme={null}
    feroxbuster --url http://app.com

    feroxbuster --url http://app.com -w /path/to/wordlist

    feroxbuster --url http://app.com -x php,html,bak,xml,txt
    ```

    I run two wordlists: `directory-list-2.3-medium.txt` and `common.txt` from...? `common.txt` has hidden files so I get those out of the way before I use the former.
  </Tab>

  <Tab title="ffuf" />
</Tabs>

# Subdomain/VHost Fuzzing

<Tabs>
  <Tab title="ffuf">
    ```
    ffuf -u http://10.10.10.10 -w /path/to/wordlist:FUZZ -H 'HOST: FUZZ.domain.local'
    ```
  </Tab>

  <Tab title="gobuster">
    ```shellscript theme={null}
    gobuster vhost -u http://app.com -w /path/to/wordlist
    ```
  </Tab>
</Tabs>

For subdomains/vhosts, I use [https://github.com/n0kovo/n0kovo\_subdomains](https://github.com/n0kovo/n0kovo_subdomains).

There's also an option with `ffuf`, `-mc all`, that will return all status codes. This is helpful for catching subdomains that hosts an API.

# Parameter Fuzzing

todo