Web Information Gathering
Web
Overview
Techniques for web application reconnaissance including subdomain enumeration, directory fuzzing, and technology fingerprinting.
2
Exercises
2
Flashcards
1
Mind Maps
Cheatsheet
Subdomains
subfinder -d domain.com # Fast passive subdomain enumeration amass enum -d domain.com # Comprehensive subdomain enumeration
Directory Fuzzing
ffuf -u http://10.10.10.5/FUZZ -w wordlist.txt # Fuzz directories with ffuf gobuster dir -u http://10.10.10.5 -w wordlist.txt # Brute force directories with gobuster
Tech Stack
whatweb http://10.10.10.5 # Identify web technologies wappalyzer # Browser extension for tech profiling
Virtual Hosts
ffuf -u http://10.10.10.5 -H 'Host: FUZZ.domain.com' -w vhosts.txt # Fuzz for virtual hosts
Command Examples
Common Pitfalls
- Not checking /robots.txt, /sitemap.xml
- Missing hidden vhosts
Exam Survival Tips
- Add discovered hostnames to /etc/hosts
- Check both HTTP and HTTPS