# Web Enumeration

***

When performing service scanning, we will often run into web servers running on ports 80 and 443. Webservers host web applications (sometimes more than 1) which often provide a considerable attack surface and a very high-value target during a penetration test. Proper web enumeration is critical, especially when an organization is not exposing many services or those services are appropriately patched.

***

### Gobuster

After discovering a web application, it is always worth checking to see if we can uncover any hidden files or directories on the webserver that are not intended for public access. We can use a tool such as [ffuf](https://github.com/ffuf/ffuf) or [GoBuster](https://github.com/OJ/gobuster) to perform this directory enumeration. Sometimes we will find hidden functionality or pages/directories exposing sensitive data that can be leveraged to access the web application or even remote code execution on the web server itself.

**Directory/File Enumeration**

GoBuster is a versatile tool that allows for performing DNS, vhost, and directory brute-forcing. The tool has additional functionality, such as enumeration of public AWS S3 buckets. For this module's purposes, we are interested in the directory (and file) brute-forcing modes specified with the switch `dir`. Let us run a simple scan using the `dirb` `common.txt` wordlist.

```bash
0xH4shDumb@htb[/htb]$ gobuster dir -u http://10.10.10.121/ -w /usr/share/seclists/Discovery/Web-Content/common.txt

===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            http://10.10.10.121/
[+] Threads:        10
[+] Wordlist:       /usr/share/seclists/Discovery/Web-Content/common.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Timeout:        10s
===============================================================
2020/12/11 21:47:25 Starting gobuster
===============================================================
/.hta (Status: 403)
/.htpasswd (Status: 403)
/.htaccess (Status: 403)
/index.php (Status: 200)
/server-status (Status: 403)
/wordpress (Status: 301)
===============================================================
2020/12/11 21:47:46 Finished
===============================================================
```

An HTTP status code of `200` reveals that the resource's request was successful, while a 403 HTTP status code indicates that we are forbidden to access the resource. A 301 status code indicates that we are being redirected, which is not a failure case. It is worth familiarizing ourselves with the various HTTP status codes, which can be found [here](https://en.wikipedia.org/wiki/List_of_HTTP_status_codes). The `Web Requests` Academy Module also covers HTTP status codes further in-depth.

The scan was completed successfully, and it identifies a WordPress installation at `/wordpress`. WordPress is the most commonly used CMS (Content Management System) and has an enormous potential attack surface. In this case, visiting `http://10.10.10.121/wordpress` in a browser reveals that WordPress is still in setup mode, which will allow us to gain remote code execution (RCE) on the server.

![WordPress language selection screen with a list of languages and a 'Continue' button.](https://cdn.services-k8s.prod.aws.htb.systems/content/modules/77/wordpress.png)

**DNS Subdomain Enumeration**

There also may be essential resources hosted on subdomains, such as admin panels or applications with additional functionality that could be exploited. We can use `GoBuster` to enumerate available subdomains of a given domain using the `dns` flag to specify DNS mode. First, let us clone the SecLists GitHub [repo](https://github.com/danielmiessler/SecLists), which contains many useful lists for fuzzing and exploitation:

**Install SecLists**

```bash
0xH4shDumb@htb[/htb]$ git clone https://github.com/danielmiessler/SecLists
```

```bash
0xH4shDumb@htb[/htb]$ sudo apt install seclists -y
```

Next, add a DNS Server such as 1.1.1.1 to the `/etc/resolv.conf` file. We will target the domain `inlanefreight.com`, the website for a fictional freight and logistics company.

```bash
0xH4shDumb@htb[/htb]$ gobuster dns -d inlanefreight.com -w /usr/share/SecLists/Discovery/DNS/namelist.txt

===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Domain:     inlanefreight.com
[+] Threads:    10
[+] Timeout:    1s
[+] Wordlist:   /usr/share/SecLists/Discovery/DNS/namelist.txt
===============================================================
2020/12/17 23:08:55 Starting gobuster
===============================================================
Found: blog.inlanefreight.com
Found: customer.inlanefreight.com
Found: my.inlanefreight.com
Found: ns1.inlanefreight.com
Found: ns2.inlanefreight.com
Found: ns3.inlanefreight.com
===============================================================
2020/12/17 23:10:34 Finished
===============================================================
```

This scan reveals several interesting subdomains that we could examine further. The [Attacking Web Applications with Ffuf](https://academy.hackthebox.com/module/details/54) module goes into more details about web enumeration and fuzzing.

***

### Web Enumeration Tips

Let us walk through a few additional web enumeration tips that will help complete machines on HTB and in the real world.

**Banner Grabbing / Web Server Headers**

In the last section, we discussed banner grabbing for general purposes. Web server headers provide a good picture of what is hosted on a web server. They can reveal the specific application framework in use, the authentication options, and whether the server is missing essential security options or has been misconfigured. We can use `cURL` to retrieve server header information from the command line. `cURL` is another essential addition to our penetration testing toolkit, and familiarity with its many options is encouraged.

```bash
0xH4shDumb@htb[/htb]$ curl -IL https://www.inlanefreight.com

HTTP/1.1 200 OK
Date: Fri, 18 Dec 2020 22:24:05 GMT
Server: Apache/2.4.29 (Ubuntu)
Link: <https://www.inlanefreight.com/index.php/wp-json/>; rel="https://api.w.org/"
Link: <https://www.inlanefreight.com/>; rel=shortlink
Content-Type: text/html; charset=UTF-8
```

Another handy tool is [EyeWitness](https://github.com/FortyNorthSecurity/EyeWitness), which can be used to take screenshots of target web applications, fingerprint them, and identify possible default credentials.

**Whatweb**

We can extract the version of web servers, supporting frameworks, and applications using the command-line tool `whatweb`. This information can help us pinpoint the technologies in use and begin to search for potential vulnerabilities.

```bash
0xH4shDumb@htb[/htb]$ whatweb 10.10.10.121

http://10.10.10.121 [200 OK] Apache[2.4.41], Country[RESERVED][ZZ], Email[license@php.net], HTTPServer[Ubuntu Linux][Apache/2.4.41 (Ubuntu)], IP[10.10.10.121], Title[PHP 7.4.3 - phpinfo()]
```

`Whatweb` is a handy tool and contains much functionality to automate web application enumeration across a network.

```bash
0xH4shDumb@htb[/htb]$ whatweb --no-errors 10.10.10.0/24

http://10.10.10.11 [200 OK] Country[RESERVED][ZZ], HTTPServer[nginx/1.14.1], IP[10.10.10.11], PoweredBy[Red,nginx], Title[Test Page for the Nginx HTTP Server on Red Hat Enterprise Linux], nginx[1.14.1]
http://10.10.10.100 [200 OK] Apache[2.4.41], Country[RESERVED][ZZ], HTTPServer[Ubuntu Linux][Apache/2.4.41 (Ubuntu)], IP[10.10.10.100], Title[File Sharing Service]
http://10.10.10.121 [200 OK] Apache[2.4.41], Country[RESERVED][ZZ], Email[license@php.net], HTTPServer[Ubuntu Linux][Apache/2.4.41 (Ubuntu)], IP[10.10.10.121], Title[PHP 7.4.3 - phpinfo()]
http://10.10.10.247 [200 OK] Bootstrap, Country[RESERVED][ZZ], Email[contact@cross-fit.htb], Frame, HTML5, HTTPServer[OpenBSD httpd], IP[10.10.10.247], JQuery[3.3.1], PHP[7.4.12], Script, Title[Fine Wines], X-Powered-By[PHP/7.4.12], X-UA-Compatible[ie=edge]
```

**Certificates**

SSL/TLS certificates are another potentially valuable source of information if HTTPS is in use. Browsing to `https://10.10.10.121/` and viewing the certificate reveals the details below, including the email address and company name. These could potentially be used to conduct a phishing attack if this is within the scope of an assessment.

![Certificate details for Megabank Limited, including subject and issuer information with country, state, locality, organization, and email address.](https://cdn.services-k8s.prod.aws.htb.systems/content/modules/77/cert.png)

**Robots.txt**

It is common for websites to contain a `robots.txt` file, whose purpose is to instruct search engine web crawlers such as Googlebot which resources can and cannot be accessed for indexing. The `robots.txt` file can provide valuable information such as the location of private files and admin pages. In this case, we see that the `robots.txt` file contains two disallowed entries.

![Robots.txt file disallowing access to /private and /uploaded\_files for all user agents.](https://cdn.services-k8s.prod.aws.htb.systems/content/modules/77/robots.png)

Navigating to `http://10.10.10.121/private` in a browser reveals a HTB admin login page.

![Login form with fields for username and password, and a login button.](https://cdn.services-k8s.prod.aws.htb.systems/content/modules/77/academy.png)

**Source Code**

It is also worth checking the source code for any web pages we come across. We can hit `[CTRL + U]` to bring up the source code window in a browser. This example reveals a developer comment containing credentials for a test account, which could be used to log in to the website.

![HTML snippet with test account credentials, meta tags, and admin login title.](https://cdn.services-k8s.prod.aws.htb.systems/content/modules/77/source.png)

***

> Try running some of the web enumeration techniques you learned in this section on the server above, and use the info you get to get the flag.

Checking the target website :&#x20;

<figure><img src="https://428993362-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMFND1xZe6YAGbm2iLxIv%2Fuploads%2FBffVhnJnSkDVkz7CPjhD%2FAcces_Cible.jpg?alt=media&#x26;token=5851da9c-8ae0-404a-8143-2d4603083bce" alt=""><figcaption></figcaption></figure>

Check the robot.txt file values :&#x20;

<figure><img src="https://428993362-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMFND1xZe6YAGbm2iLxIv%2Fuploads%2FGRORgYl1nVSSwY3pnph4%2FRobots_txt.jpg?alt=media&#x26;token=e0171426-93f2-41f1-8762-d3e1aa4208be" alt=""><figcaption></figcaption></figure>

We can see an /admin-login-page.php page :

<figure><img src="https://428993362-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMFND1xZe6YAGbm2iLxIv%2Fuploads%2FhAqzEnPbD7R9izAxLMNA%2FSource_Admin_cible.jpg?alt=media&#x26;token=cbfa93b5-0a81-4baf-af33-056cc6834124" alt=""><figcaption></figcaption></figure>

With admin creds, we connects to the login form :

<figure><img src="https://428993362-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FMFND1xZe6YAGbm2iLxIv%2Fuploads%2F8aULtK3hU7yyHqMT08BL%2F%7B3C6211E0-3AE1-4F0B-AE7B-7312A86B4DAC%7D.png?alt=media&#x26;token=5c2be189-f3b1-4bb0-b222-ace9e0a1c8bd" alt=""><figcaption></figcaption></figure>

***
