Web server enumeration

A web server accepts HTTP or HTTPS requests and returns resources such as HTML pages, images, scripts, API responses and downloadable files. Common web servers include Apache, Nginx and Microsoft IIS.

HTTP commonly uses TCP port 80 and HTTPS commonly uses TCP port 443. Web applications may also run on alternative ports such as 8000, 8080, 8443 or application-specific ports.

Start by identifying open web ports, server software, page titles and technologies exposed by the service.

Response headers can reveal server software, cookies, authentication mechanisms, redirects, security controls and application behaviour.

Headers such as Server or X-Powered-By may reveal web-server or application technologies. These values can be hidden or modified, so they should not be treated as definitive without additional evidence.

The HTML title can quickly indicate which application, administrative panel or product is running on a web port.

robots.txt tells search-engine crawlers which paths they should avoid indexing. These paths are not secret and can reveal interesting administrative, backup or application directories.

HTTP supports multiple request methods. Common methods include GET, POST, HEAD and OPTIONS. Other methods such as PUT or DELETE can become security-relevant when they are enabled in an unsafe context.

OPTIONS asks the server which HTTP methods or communication options are available for a resource.

PUT can be used to create or replace a resource when the server and target path allow it. Simply seeing PUT advertised does not prove that arbitrary file upload is possible.

DELETE requests removal of a resource. Like PUT, its presence in an Allow header does not automatically mean unauthenticated users can use it successfully.

Directory listing occurs when a web server displays the files contained in a directory instead of serving a default index file. This can expose backups, documents, configuration files and other unintended content.

Content discovery attempts to identify directories and endpoints that are not directly linked from the main website.

Enumeration should also look for files such as backups, configuration files, archives, scripts and administrative resources. File extensions may provide clues about the backend technology.

FFUF is useful for advanced directory, file, parameter, virtual-host and fuzzing workflows. It is better documented in a dedicated fuzzing note rather than duplicating all of its functionality here.

Identify login pages, administrative panels and paths protected by HTTP authentication. Different authentication mechanisms produce different response headers and status codes.

HTTP Basic authentication transmits a base64-encoded username and password inside the Authorization header. HTTPS is required to protect those credentials in transit.

Status codes help interpret application behaviour. 200 indicates success, 301 and 302 redirects, 401 authentication required, 403 forbidden, 404 not found and 500 a server-side error.

Some web-server configurations expose per-user directories, historically through paths such as /~username/. Whether this is enabled depends on the server configuration.

A single IP address may host multiple websites selected through the HTTP Host header. Finding additional hostnames can reveal applications that are not visible when browsing the IP directly.

HTTPS is HTTP transported over TLS. TLS enumeration can reveal certificate names, validity periods and additional hostnames through certificate fields.

TLS certificates may contain Common Name and Subject Alternative Name entries associated with the service. These names can provide useful hostname-enumeration leads.

Nmap includes many HTTP NSE scripts for titles, headers, supported methods, directories and application-specific enumeration.

Metasploit includes auxiliary modules for web-server version detection, directory enumeration and other HTTP checks. Search for modules relevant to the discovered service instead of relying on one universal scanner.

HTML and JavaScript may reveal endpoints, API paths, comments, application versions and client-side configuration. Browser developer tools and curl can help inspect the returned content.

During authorised enumeration, pay attention to backups, archives, configuration remnants, source files, documentation and version-control artifacts that may have been exposed unintentionally.

WebDAV extends HTTP with functionality for remotely managing web resources. Although WebDAV relies on HTTP methods, its enumeration and misconfiguration testing are broad enough to belong in a dedicated note.

Shellshock is a specific Bash CGI vulnerability and should not be treated as part of generic web-server enumeration. Generic HTTP enumeration may discover CGI endpoints, but vulnerability testing belongs in its own note.

SQL injection is an application vulnerability rather than a generic web-server enumeration technique. This note focuses on identifying the HTTP service, application surface and exposed resources.

Identify all HTTP and HTTPS ports, inspect page titles and headers, retrieve robots.txt, enumerate supported methods, discover directories and files, identify authentication areas and virtual hosts, then inspect TLS certificates and application content for additional enumeration leads.

These are the HTTP and HTTPS enumeration commands worth remembering.