Wstg Info 04

wstg-info-04

Test ID

WSTG-INFO-04

Test Name

Enumerate Applications on Webserver

High-Level Description

A single web server can host multiple web applications accessible through different URLs, ports, or virtual hosts. This test aims to comprehensively discover all web applications running on the target infrastructure. Missing applications during enumeration can result in overlooking critical vulnerabilities. Applications may be hidden at non-standard URL paths, running on unusual ports, or accessible only through specific hostnames (virtual hosting).

What to Check

Discovery Vectors

• Non-standard URL paths (/app1, /app2, /admin, /api)
• Non-standard ports (8080, 8443, 3000, 4443, etc.)
• Virtual hosts (different hostnames on same IP)
• Subdomains (app.target.com, admin.target.com)
• Load balancer backends
• Hidden administrative interfaces
• API endpoints
• Development/staging environments
• Legacy applications

Information to Gather

• Complete list of applications
• URL paths for each application
• Ports used by each service
• Hostnames/virtual hosts
• Technology stack per application
• Application versions
• Authentication requirements

How to Test

Step 1: Port Scanning

Full Port Scan with Nmap

# Comprehensive TCP scan (all ports)
nmap -Pn -sT -sV -p0-65535 target.com

# Quick scan of common web ports
nmap -Pn -sV -p 80,443,8080,8443,8000,3000,4443,5000,9000,9443 target.com

# Service version detection with scripts
nmap -sV --script=http-enum -p 80,443,8080,8443 target.com

# UDP scan for additional services
nmap -sU -p 80,443,8080 target.com

Masscan for Large Ranges

# Fast full port scan
masscan -p0-65535 target.com --rate=1000

# Scan with banner grabbing
masscan -p0-65535 target.com --rate=1000 --banners

Common Web Service Ports

Step 2: Non-Standard URL Enumeration

Directory Brute-forcing

# Gobuster
gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt -t 50

# With extensions
gobuster dir -u https://target.com -w wordlist.txt -x php,asp,aspx,jsp,html -t 50

# ffuf
ffuf -u https://target.com/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt

# Dirsearch
dirsearch -u https://target.com -e php,asp,aspx,jsp

# feroxbuster (recursive)
feroxbuster -u https://target.com -w wordlist.txt

Common Application Paths

# Check common paths manually
for path in admin administrator manager console portal api app webapp webmail mail owa cpanel phpmyadmin adminer jenkins gitlab sonar grafana kibana elastic; do
    status=$(curl -s -o /dev/null -w "%{http_code}" "https://target.com/$path")
    echo "$path: $status"
done

Common Application URL Patterns

/admin/
/administrator/
/manager/
/console/
/portal/
/api/
/api/v1/
/api/v2/
/app/
/webapp/
/webmail/
/mail/
/owa/
/cpanel/
/phpmyadmin/
/adminer/
/jenkins/
/gitlab/
/grafana/
/kibana/
/elastic/
/solr/
/sonar/
/nagios/
/zabbix/
/cacti/
/munin/

Step 3: Virtual Host Discovery

DNS Enumeration

# Get nameservers
dig NS target.com
host -t ns target.com
nslookup -type=ns target.com

# Attempt zone transfer
dig axfr target.com @ns1.target.com
host -l target.com ns1.target.com

# Reverse DNS lookup
dig -x <target_ip>
host <target_ip>

Subdomain Enumeration

# Amass
amass enum -d target.com

# Subfinder
subfinder -d target.com

# Assetfinder
assetfinder target.com

# DNSRecon
dnsrecon -d target.com -t std

# Sublist3r
sublist3r -d target.com

Certificate Transparency

# crt.sh
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u

# Certspotter
curl -s "https://api.certspotter.com/v1/issuances?domain=target.com&include_subdomains=true" | jq '.[].dns_names[]'

Virtual Host Brute-forcing

# ffuf vhost discovery
ffuf -u https://target.com -H "Host: FUZZ.target.com" -w subdomains.txt -fs <filter_size>

# Gobuster vhost
gobuster vhost -u https://target.com -w subdomains.txt

# Virtual host scanner
python3 VHostScan.py -t target.com -w wordlist.txt

Step 4: SSL/TLS Certificate Analysis

# Extract SAN from certificate
echo | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -noout -text | grep -A1 "Subject Alternative Name"

# Full certificate details
echo | openssl s_client -connect target.com:443 2>/dev/null | openssl x509 -noout -text

# Extract CN and SAN
openssl s_client -connect target.com:443 </dev/null 2>/dev/null | openssl x509 -noout -text | grep -E 'DNS:|Subject:'

# Multiple hosts
for host in target.com www.target.com api.target.com; do
    echo "=== $host ==="
    echo | openssl s_client -connect $host:443 -servername $host 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName
done

Step 5: Reverse IP Lookup

# Using online services (manual)
# - viewdns.info/reverseip/
# - bing.com (ip:x.x.x.x)
# - shodan.io

# Bing search for IP
# ip:93.184.216.34

# Shodan CLI
shodan host <target_ip>

Step 6: Search Engine Discovery

# Google dorks
site:target.com
site:*.target.com
site:target.com inurl:admin
site:target.com inurl:login

# Bing
site:target.com
ip:<target_ip>

Step 7: Verify Discovered Applications

# Check each discovered host/port
for url in $(cat discovered_urls.txt); do
    echo "=== $url ==="
    curl -sI "$url" | head -10
done

# httpx for bulk verification
cat hosts.txt | httpx -title -status-code -tech-detect

# EyeWitness for screenshots
eyewitness --web -f urls.txt -d output/

Tools

Port Scanning

Directory/Application Discovery

Subdomain/Virtual Host Discovery

Verification/Analysis

Online Services

Example Commands/Payloads

Comprehensive Enumeration Script

#!/bin/bash
TARGET=$1

echo "=== APPLICATION ENUMERATION ==="
echo "Target: $TARGET"
echo ""

# 1. Port Scan
echo "[+] Port Scanning..."
nmap -sV -p 80,443,8080,8443,8000,3000,4443,5000,9000 $TARGET -oN nmap_web.txt

# 2. Subdomain Enumeration
echo "[+] Subdomain Enumeration..."
subfinder -d $TARGET -o subdomains.txt
amass enum -passive -d $TARGET >> subdomains.txt
sort -u subdomains.txt -o subdomains.txt

# 3. Certificate Analysis
echo "[+] Certificate Analysis..."
echo | openssl s_client -connect $TARGET:443 2>/dev/null | openssl x509 -noout -text | grep -E 'DNS:|Subject:' > cert_info.txt

# 4. DNS Zone Transfer Attempt
echo "[+] Zone Transfer Attempt..."
for ns in $(dig NS $TARGET +short); do
    dig axfr $TARGET @$ns
done

# 5. Directory Brute-force
echo "[+] Directory Enumeration..."
gobuster dir -u https://$TARGET -w /usr/share/seclists/Discovery/Web-Content/common.txt -o dirs.txt -q

# 6. Virtual Host Discovery
echo "[+] Virtual Host Discovery..."
ffuf -u https://$TARGET -H "Host: FUZZ.$TARGET" -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -o vhosts.txt -fs 0

# 7. Verify all discovered hosts
echo "[+] Verifying Hosts..."
cat subdomains.txt | httpx -silent -title -status-code -tech-detect -o live_hosts.txt

echo "[+] Enumeration Complete"

Nmap Web Service Detection

# Detect all HTTP services
nmap -sV -p- --script=http-title,http-server-header target.com

# Scan common web ports with NSE scripts
nmap -p 80,443,8080,8443 --script=http-enum,http-headers,http-methods target.com

# Identify web application technologies
nmap -p 80,443 --script=http-generator,http-php-version target.com

Mass Virtual Host Check

#!/bin/bash
IP=$1
DOMAIN=$2
WORDLIST=$3

while read subdomain; do
    host="$subdomain.$DOMAIN"
    response=$(curl -s -H "Host: $host" -o /dev/null -w "%{http_code}:%{size_download}" http://$IP)
    code=$(echo $response | cut -d: -f1)
    size=$(echo $response | cut -d: -f2)
    echo "$host - Status: $code, Size: $size"
done < $WORDLIST

Aquatone Pipeline

# Full discovery pipeline
cat domains.txt | amass enum -passive -df - | httpx -silent | aquatone -out screenshots/

Remediation Guide

1. Application Inventory

• Maintain comprehensive documentation of all web applications
• Include URLs, ports, hostnames, and responsible teams
• Regular audits to identify undocumented applications
• Implement change management for new applications

2. Network Segmentation

# Example: Separate admin interfaces
- Public applications: DMZ segment
- Admin interfaces: Internal network only
- Development: Isolated segment

3. Access Control

• Restrict administrative interfaces to internal networks
• Implement IP whitelisting where possible
• Use VPN for remote admin access
• Enable authentication for all applications

4. DNS Security

# Restrict zone transfers (BIND example)
zone "example.com" {
    type master;
    file "example.com.zone";
    allow-transfer { none; };
    # Or specific IPs only
    allow-transfer { 192.168.1.2; };
};

5. Port Management

• Close unnecessary ports
• Use firewall rules to restrict access
• Monitor for new services
• Regular port audits

6. Virtual Host Configuration

# Apache - Disable default vhost response
<VirtualHost *:80>
    ServerName default.invalid
    Redirect 404 /
</VirtualHost>

# nginx - Default server block
server {
    listen 80 default_server;
    server_name _;
    return 444;
}

7. Monitoring

• Implement logging for all web services
• Monitor for unauthorized applications
• Alert on new services starting
• Regular security scans

Risk Assessment

CVSS Score

Base Score: 5.3 (Medium)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Severity Levels

CWE Categories

References

OWASP References

• OWASP WSTG - Enumerate Applications on Webserver

Tools Documentation

• Nmap Documentation
• Gobuster GitHub
• Amass GitHub
• ffuf GitHub

Wordlists

• SecLists
• Assetnote Wordlists

Checklist

[ ] Full port scan completed (all 65535 ports)
[ ] Common web ports verified
[ ] Non-standard URL paths enumerated
[ ] Subdomain enumeration performed
[ ] DNS zone transfer attempted
[ ] Certificate transparency checked
[ ] SSL/TLS certificates analyzed for SANs
[ ] Virtual host brute-forcing completed
[ ] Reverse IP lookup performed
[ ] Search engine reconnaissance done
[ ] All discovered applications documented
[ ] Applications verified and accessible
[ ] Technologies identified per application
[ ] Screenshots captured (EyeWitness/Aquatone)
[ ] Risk assessment completed
[ ] Findings documented