> For the complete documentation index, see [llms.txt](https://yongjun04.gitbook.io/oscp-cheatsheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yongjun04.gitbook.io/oscp-cheatsheet/methodology/service-enumeration/tcp-http-s-80-443.md).

# TCP: HTTP(S) - 80 / 443

**NOTE: Remember to update /etc/hosts if there is any redirect issues to target site**

**NOTE: While waiting for the scan to be completed, do the following**

* Attempt Weak Credentials on any login features found
* Look for user input fields
* Look for file upload fields
* Run through source code of webpages

## Interesting Files

> robots.txt
>
> sitemap.xml

## Directory Enumeration

### Wordlists

```
/usr/share/wordlists/dirb/common.txt
/usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt
/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
/usr/share/wordlists/dirb/big.txt
/usr/share/wordlists/dirb/small.txt
```

### GoBuster

* HTTP - Port 80

> The following command brute forces web directories and files against a target IP

{% code overflow="wrap" %}

```bash
gobuster dir -u http://<IP Address>/ -w <Word Lists> -t 42 -b 400,401,404 -f -o <>.gobuster
```

{% endcode %}

> The following command brute forces web directories and files against a target IP and trying various file extensions

{% code overflow="wrap" fullWidth="false" %}

```bash
gobuster dir -u http://<IP Address>/ -w <Word Lists> -x php,txt,xml,asp,aspx -t 42 -b 400,401,404 -f -o <>.gobuster
```

{% endcode %}

* HTTPS - Port 443

> The following command brute forces directories and files over HTTPS, ignoring SSL errors, trying multiple file extensions

{% code overflow="wrap" %}

```bash
gobuster dir -u https://<IP Address>/ -k -w <Word Lists> -x php,txt,xml,asp,aspx -t 42 -b 400,401,404 -f -o <>.gobuster
```

{% endcode %}

***

### Dirbuster

> The following is a command to run Dirbuster - another alternatives to GoBuster

```bash
dirb http://<IP Address>/
```

***

### Fuzz Faster U Fool (FFUF)

> The following is a command to brute force directories/files on the target at the root path using FFUF

{% code overflow="wrap" %}

```bash
ffuf -c -u http:///FUZZ -w <Word Lists>
```

{% endcode %}

***

## Vulnerability Scanning

### Nmap

> The following command scans port 80 and retrieves the HTTP response headers from the web server

```bash
nmap -p80 --script http-headers <IP Address>
```

> The following command scans port 80 and extracts the title of the web page from the HTML response.

```bash
nmap -p80 --script http-title <IP Address>
```

> The following command scans port 80, detects the service version, and checks for known vulnerabilities (CVEs) against it.

```bash
nmap -p80 -sV --script vulners <IP Address>
```

***

### nikto

> The following command scans the target web server for common vulnerabilities, misconfigurations, outdated software, and dangerous files using Nikto.

```bash
nikto -host http://<IP Address>/
```

***

## WordPress Scan

**NOTE: Look for signs that it is a WordPress site**

* URL paths include "wp-admin", "wp-content", "wp-login.php", "wp-includes"

Determine attack surface

```bash
whatweb http://<Target IP Address>
```

> The following command scans the WordPress site to enumerate all installed plugins and all users.

```bash
wpscan --url http://<Target IP Address> --enumerate ap u
```

> The following command scans the WordPress site to enumerate plugins (p) using aggressive detection methods

{% code overflow="wrap" %}

```bash
wpscan --url http://<Target IP Address> --enumerate p --plugins-detection aggressive -o <>.wpscan
```

{% endcode %}