HTTP Enumeration for Pentesters: Foundations and Steps to Follow

 HTTP enumeration involves discovering web servers, web applications, directories, files, and server configurations that may contain vulnerabilities or misconfigurations that can be exploited by attackers. As a pentester, HTTP enumeration is a crucial step in identifying potential attack vectors and vulnerabilities.


To begin HTTP enumeration, you should start with the following steps:


Web server fingerprinting: Use a web application scanner such as Nmap or WhatWeb to identify web servers and server technologies. Use the following command to scan for web servers:


nmap -p 80,443 --script http-enum <target IP>


This will scan for web servers on ports 80 and 443, and enumerate server technologies.


Directory enumeration: Once you have identified web servers, you can use a tool such as Dirb or Dirbuster to enumerate directories and files on the web server. Use the following command to run Dirb:


dirb http://<target IP> /usr/share/dirb/wordlists/common.txt


This will scan for common directories and files on the web server.


File enumeration: Once you have identified directories, you can use a tool such as Dirbuster or WFuzz to enumerate files and subdirectories. Use the following command to run Dirbuster:


dirbuster -u http://<target IP>/ -l /usr/share/dirbuster/wordlists/files.txt -e php


This will scan for common file types such as PHP files in the identified directories.


Server configuration enumeration: Once you have identified web servers and web applications, you can use a tool such as Nikto or OpenVAS to enumerate server configurations and vulnerabilities. Use the following command to run Nikto:


nikto -h <target IP>


This will scan for server configurations and vulnerabilities.


Exploitation: Once you have identified vulnerabilities or misconfigurations, you can attempt to exploit them using tools such as Metasploit or manual exploitation techniques.


It is important to note that HTTP enumeration and exploitation should only be performed on systems that you have permission to test. Unauthorized access to computer systems is illegal and can result in severe consequences.