> For the complete documentation index, see [llms.txt](https://michel-disbergen.gitbook.io/hack-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://michel-disbergen.gitbook.io/hack-notes/web-pentesting/1.-web-checklist.md).

# 1. Web checklist

* [ ] 1\. **Understand System Context**

<pre class="language-bash"><code class="lang-bash">#####
# 1. Identify the main purpose of the webapp  
#####

#####
# 2. If possible, identify a version of the app or software being used by checking:
<strong>- source code
</strong>- http headers
- through a changelog file 
- through a readme.MD file
- through public github repositories (cs.github.com)

# - if a version is found; checkout known vulnerabilities for that version using
- google
- exploit-db
- sploitus

#####
# 3. Check links, do any of them refer to internal apps or other internal services?
# 4. Identify the main features and functionalities of the web application
# 5. Find user inputs &#x26; take note of them
# 6. Find the "happy flows" and take note of them
# 7. Identify user roles and permissions

</code></pre>

* [ ] **2. Run Specialized Scanners**

```bash
# 1. If applicable, run a CMS scanner based on the identified CMS
                    
# wpscan - https://github.com/wpscanteam/wpscan 
# joomscan - https://github.com/OWASP/joomscan
# cmsmap - https://github.com/dionach/CMSmap
```

* [ ] **3. Crawl the website for hidden content**

```bash
# 1. Utilize katana to crawl the webapp for hidden content
katana -u http://{{RHOST}} -headless -no-incognito | tee katana_output.txt
```

* [ ] **4. Directory & file fuzzing**

```bash
# 1. Use feroxbuster with 'common' wordlist
feroxbuster -u http://{{RHOST}} -t 10 -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt -x "txt,html,php,asp,aspx,jsp,pdf" -v -k -o feroxbuster_common.txt [--add-slash]                                       
                    
# 2. Use feroxbuster with 'medium' wordlist
feroxbuster -u http://{{RHOST}} -t 10 -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -x "txt,html,php,asp,aspx,jsp,pdf" -v -k -o feroxbuster_medium.txt [--add-slash]

# 3. Use feroxbuster with 'big' wordlist
feroxbuster -u http://{{RHOST}} -t 10 -w /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-lowercase-2.3-big.txt -x "txt,html,php,asp,aspx,jsp,pdf" -v -k -o feroxbuster_big.txt [--add-slash]

##### useful options:
# -t : number of threads
# -x : file extensions to look for
# -k : skip SSL verification
# -r : follow redirects
# --add-slash : appends a slash
# --rate-limit 5 : limit requests to 5 per second (combine with -t)
# -H "Cookie: KEY=VALUE" : Use a cookie
```

* [ ] **5. Virtual host fuzzing**

```bash
# 1. Virtual host fuzzing
ffuf -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://{{RHOST}}/ -H "Host: FUZZ.{{RHOST}}"
           
##### useful options:
# - fs : filter on size
# - fw : filter on words
```

* [ ] **6. Parameter fuzzing**

```bash
# 1. parameter fuzzing
ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -u http://{{RHOST}}/?FUZZ=id
           
##### useful options:
# - fs : filter on size
# - fw : filter on words
# -H "key: value" : add header(s)
```

* [ ] **7. Analyze Page Comments and source code**

```bash
# 1. Examine HTML comments and source code on main and secondary pages for sensitive data.
Utilize the 'comment extractor' feature within this plugin
```

* [ ] **8. Test default & software credentials**

```bash
# 1. Use common default credentials
admin:admin
admin:password
root:admin
root:password
root:root
[boxname]:admin
[boxname]:password
[appName]:[appName]
admin:no pass
root:no pass

# 2. use the software name as username/ password combination
# e.g. wordpress:wordpress, joomla:joomla, drupal:drupal, magento:magento, nexus:nexu
```

* [ ] **9. Check if webdav is enabled**

```bash
# 1. check if webdav is enabled
##### REFERENCE: https://hackviser.com/tactics/pentesting/services/webdav
# HTTP methods enumeration
nmap -p 80,443 --script http-methods target.com
nmap -p 80,443 --script http-webdav-scan target.com

# WebDAV path detection
nmap -p 80 --script http-webdav-scan --script-args http-webdav-scan.path=/webdav/ {{RHOST}}

# Common paths
/webdav/
/dav/
/WebDAV/
/uploads/
/files/
/_vti_bin/
/sharepoint/

# 2. authentication bypass
curl -X OPTIONS http://target.com/webdav/
curl -X PROPFIND http://target.com/webdav/

# Try with default credentials
admin:admin
admin:password
webdav:webdav

# Test authentication
curl -X PROPFIND http://target.com/webdav/ -u admin:admin
```

* [ ] **10. 403-bypass**

```bash
# 1. try to bypass the 403 page with common bypass techniques (https://github.com/0xrisec/4-ZERO-3/)
403-bypass.sh -u http://{{RHOST}}/logs --header | tee 403_bypass_output.txt

# 2. or try with all techniques that are known
403-bypass.sh -u http://{{RHOST}}/logs --exploit | tee 403_bypass_output.txt

# 3. check the output
# > filter on status, e.g.: 400, 200, 403, 404
# > then filter on length, e.g.:
cat 403_bypass_output.txt | grep "404" | cut -d "," -f 2 | cut -d ":" -f 2 | sort
```

```
```