Skip to content
Home

Web server & HTTP enumeration

Directory brute-forcing, header/version fingerprinting, and HTTP-verb testing against a web target.

bash·1 min read··INE Certification

A useful order of operations: identify the server and its version, pull its headers, check robots.txt, then brute-force directories/files, and only then start probing individual endpoints or user accounts. HTTP uses port 80 by default and 443 when TLS is configured; they’re the same protocol, not two separate things to enumerate independently.

Nmap

nmap -sS -sV -p80,443 <target_ip>                  # confirm the server + version
nmap --script http-enum -sV -p80 <target_ip>       # enumerate common paths
nmap --script http-headers -sV -p80 <target_ip>
nmap --script http-methods -p80 <target_ip>        # which HTTP verbs are allowed
nmap --script http-webdav-scan --script-args http-methods.url-path=/webdav/ -p80 <target_ip>

Directory and file brute-force

dirb http://<target_ip>
gobuster dir -u http://<target_ip> -w /usr/share/wordlists/dirb/common.txt -b 403,404 -t 60

curl

curl <target_ip>                    # basic GET
curl -I <target_ip>                 # headers only
curl --digest -u alice:password1 http://<target_ip>/protected/    # authenticated request, digest auth
curl -X OPTIONS <target_ip> -v      # check which methods a specific path allows
curl -X PUT <target_ip>             # test if uploads are accepted (misconfigured WebDAV/servers)

Fingerprinting and browsing

whatweb <target_ip>                     # fingerprint the stack (server, CMS, JS libs)
http <target_ip>                        # httpie — curl-like syntax, nicer output
browsh --startup-url http://<target_ip>   # full terminal browser when you need rendered JS

Metasploit

auxiliary/scanner/http/http_version        # identify server version
auxiliary/scanner/http/http_header         # pull headers
auxiliary/scanner/http/robots_txt          # check robots.txt content
auxiliary/scanner/http/dir_scanner         # HTTP directory scanner
auxiliary/scanner/http/files_dir           # HTTP file scanner
auxiliary/scanner/http/http_login          # brute-force a login form
auxiliary/scanner/http/apache_userdir_enum # Apache user directory enumeration
auxiliary/scanner/http/http_put            # test upload/delete via HTTP PUT/DELETE
auxiliary/scanner/http/http_git            # check for an exposed .git directory

Tips

  • Response headers often leak the exact server/framework/language stack even when whatweb doesn’t catch it.
  • For anything beyond simple brute-forcing (crawling a full app, spidering discovered links, intercepting and replaying requests), Burp Suite’s crawler or OWASP ZAP’s spider are the standard next step up from directory wordlists alone.