80, 443 - Web Service Pentesting Methodology

Step-by-step methodology for pentesting HTTP/HTTPS web services: technology fingerprinting, spidering, directory brute-forcing, vulnerability checking, and automated scanning.

The web service is the most common and extensive service and a wide variety of vulnerability types exist.

Default Ports: 80 (HTTP), 443 (HTTPS)

nc -v domain.com 80          # GET / HTTP/1.0
openssl s_client -connect domain.com:443  # GET / HTTP/1.0

Methodology Overview

1. Identify Technologies

   Find the technologies being used to look for known vulnerabilities and useful tricks.

   whatweb -a 1 <URL>   # Stealthy
   whatweb -a 3 <URL>   # Aggressive
   webtech -u <URL>
   webanalyze -host https://target.com -crawl 2
   
2. Check for WAF

   wafw00f <URL>
   nmap --script http-waf-detect <IP>
   
3. Launch General Scanners

   nikto -h <URL>
   whatweb -a 4 <URL>
   nuclei -ut && nuclei -target <URL>
   zaproxy  # Via API
   
4. Initial Checks

   Check default informational pages:

   • /robots.txt
   • /sitemap.xml
   • /crossdomain.xml
   • /.well-known/
   • Check comments in main and secondary pages

   Run SSL/TLS scan if HTTPS:

   ./testssl.sh 10.10.10.10:443
   sslscan <host:port>
   sslyze --regular <ip:port>
   
5. Spider the Application

   Find all possible files, folders, and parameters:

   gospider -s https://target.com
   hakrawler -url https://target.com
   katana -u https://target.com
   gau target.com  # Uses wayback, otx, commoncrawl
   
6. Directory Brute-Forcing

   # Feroxbuster (fast, recursive)
   feroxbuster -u https://target.com -w /usr/share/wordlists/dirb/big.txt
   
   # ffuf
   ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://target.com/FUZZ
   
   # gobuster
   gobuster dir -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
     -u https://target.com
   
   # dirsearch (recursive)
   python3 dirsearch.py -w small_dirlist -e php,html,py -u https://target.com -r
   
7. Backup Checking

   Check for backup files appending common extensions: file.ext~, #file.ext#, ~file.ext, file.ext.bak, file.ext.tmp, file.ext.old

8. Parameter Discovery

   # Arjun
   arjun -u https://target.com/endpoint
   
   # Param Miner (Burp extension)
   # x8
   x8 -u https://target.com/endpoint
   
9. Vulnerability Checking

   Use the web vulnerabilities methodology checklist for all discovered endpoints.

Technology-Specific Tricks

CMS Scanners

# WordPress
wpscan --force update -e --url <URL>
wpscan --url <URL> --enumerate u,ap,at,cb,dbe

# Joomla
joomscan --ec -u <URL>

# Drupal
droopescan scan drupal -u <URL>

# Generic CMS
cmsmap [-f W] -F -d <URL>

Source Code Review

If source code is available on GitHub:

• Check Change-log/Readme for version info
• Look for credentials in code, configs, commit history
• Search for hash algorithms, encryption keys
• Check Issues for unresolved vulnerabilities

Special Findings

• .git directory exposed → extract source code
• .env file → API keys, DB passwords
• JS files → use RetireJS to check for known vulnerabilities
• API endpoints → test for API-specific vulnerabilities
• 403 Forbidden → try bypass techniques
• 502 Proxy Error → potential misconfigured proxy/SSRF
• NTLM Authentication → info disclosure via NTLM challenge

NTLM Authentication Info Disclosure

# Windows servers with NTLM auth disclose version info
curl -s -I -H "Authorization: NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=" \
  http://target.com/
# Check WWW-Authenticate header for IIS and Windows version

# Automated with nmap
nmap -p 80,443 --script http-ntlm-info <IP>

Automated Command Reference

# Quick web scan (Nikto + Gobuster)
nikto -host http://<IP>:<PORT> && \
gobuster dir -w <Small_Dirlist> -u http://<IP>:<PORT> && \
gobuster dir -w <Big_Dirlist> -u http://<IP>:<PORT>

# WhatWeb
whatweb -a 4 <IP>

# Nmap web vuln scan
nmap -vv --reason -Pn -sV -p <Port> \
  --script="banner,(http* or ssl*) and not (brute or broadcast or dos or fuzzer)" <IP>

# WordPress
wpscan --url http://<IP>/wp-login.php --enumerate ap,at,cb,dbe && \
wpscan --url http://<IP>/wp-login.php --enumerate u,tt,t,vp --passwords <Big_Passwordlist>

# Ffuf vhost discovery
ffuf -w <Subdomain_List>:FUZZ -u http://<Domain_Name> -H "Host: FUZZ.<Domain_Name>" \
  -c -mc all -fs <common_size>

SSL/TLS Vulnerability Reference

• No HTTPS enforcement → MitM possible
• Sensitive data in HTTP → high severity
• Check for BEAST, POODLE, HEARTBLEED, ROBOT, DROWN via testssl.sh