Web MOC

---

Web Enumeration

• Search Engine Basics

• WHOIS

• Subdomain

• Protocols

  • HTTP Protocol
  • DNS Protocol
  • Cookies

• Programming

  • HTML
  • JavaScript
  • PHP

• Tools

  • Nikto general scanning
  • WafW00f WAF scanning
  • FinalRecon
  • Recon-ng
  • theHarvester
  • SpiderFoot
  • OSINT Framework.

• Methodology

  • click around on website
  • check robots.txt, sitemap.xml, /.well-known/
  • default cred
  • inspect page source
  • write down everything interesting

• Recon

  • Check subdomains
  • fuzzing
  • port scanning
  • google dorking
  • check exposed .git directories

• Tools

  • Directory enumeration
    • Ffuf
    • Dirbuster
  • Recon
    • Wappalyzer
    • Burp suite
  • SQLmap
  • WPScan
  • Nuclei
  • Synk
  • Curl/wget

• Common Vuln

  • SQL injection
  • XSS
  • Insecure Direct Object Reference
  • Broken Access Control
  • Authentication bypass
  • Server-side request forgetrt
  • file upload
  • path traversal
  • sensitive data

To Do

• [ ]