> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/HackTricks-wiki/hacktricks/llms.txt
> Use this file to discover all available pages before exploring further.

# 80, 443 - Web Service Pentesting Methodology

> Step-by-step methodology for pentesting HTTP/HTTPS web services: technology fingerprinting, spidering, directory brute-forcing, vulnerability checking, and automated scanning.

The web service is the most **common and extensive service** and a wide variety of vulnerability types exist.

**Default Ports:** 80 (HTTP), 443 (HTTPS)

```bash theme={null}
nc -v domain.com 80          # GET / HTTP/1.0
openssl s_client -connect domain.com:443  # GET / HTTP/1.0
```

## Methodology Overview

<Steps>
  <Step title="Identify Technologies">
    Find the technologies being used to look for known vulnerabilities and useful tricks.

    ```bash theme={null}
    whatweb -a 1 <URL>   # Stealthy
    whatweb -a 3 <URL>   # Aggressive
    webtech -u <URL>
    webanalyze -host https://target.com -crawl 2
    ```
  </Step>

  <Step title="Check for WAF">
    ```bash theme={null}
    wafw00f <URL>
    nmap --script http-waf-detect <IP>
    ```
  </Step>

  <Step title="Launch General Scanners">
    ```bash theme={null}
    nikto -h <URL>
    whatweb -a 4 <URL>
    nuclei -ut && nuclei -target <URL>
    zaproxy  # Via API
    ```
  </Step>

  <Step title="Initial Checks">
    Check default informational pages:

    * `/robots.txt`
    * `/sitemap.xml`
    * `/crossdomain.xml`
    * `/.well-known/`
    * Check comments in main and secondary pages

    Run SSL/TLS scan if HTTPS:

    ```bash theme={null}
    ./testssl.sh 10.10.10.10:443
    sslscan <host:port>
    sslyze --regular <ip:port>
    ```
  </Step>

  <Step title="Spider the Application">
    Find all possible files, folders, and parameters:

    ```bash theme={null}
    gospider -s https://target.com
    hakrawler -url https://target.com
    katana -u https://target.com
    gau target.com  # Uses wayback, otx, commoncrawl
    ```
  </Step>

  <Step title="Directory Brute-Forcing">
    ```bash theme={null}
    # Feroxbuster (fast, recursive)
    feroxbuster -u https://target.com -w /usr/share/wordlists/dirb/big.txt

    # ffuf
    ffuf -c -w /usr/share/wordlists/dirb/big.txt -u http://target.com/FUZZ

    # gobuster
    gobuster dir -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt \
      -u https://target.com

    # dirsearch (recursive)
    python3 dirsearch.py -w small_dirlist -e php,html,py -u https://target.com -r
    ```
  </Step>

  <Step title="Backup Checking">
    Check for backup files appending common extensions:
    `file.ext~`, `#file.ext#`, `~file.ext`, `file.ext.bak`, `file.ext.tmp`, `file.ext.old`
  </Step>

  <Step title="Parameter Discovery">
    ```bash theme={null}
    # Arjun
    arjun -u https://target.com/endpoint

    # Param Miner (Burp extension)
    # x8
    x8 -u https://target.com/endpoint
    ```
  </Step>

  <Step title="Vulnerability Checking">
    Use the web vulnerabilities methodology checklist for all discovered endpoints.
  </Step>
</Steps>

## Technology-Specific Tricks

<AccordionGroup>
  <Accordion title="CMS Scanners">
    ```bash theme={null}
    # WordPress
    wpscan --force update -e --url <URL>
    wpscan --url <URL> --enumerate u,ap,at,cb,dbe

    # Joomla
    joomscan --ec -u <URL>

    # Drupal
    droopescan scan drupal -u <URL>

    # Generic CMS
    cmsmap [-f W] -F -d <URL>
    ```
  </Accordion>

  <Accordion title="Source Code Review">
    If source code is available on GitHub:

    * Check Change-log/Readme for version info
    * Look for credentials in code, configs, commit history
    * Search for hash algorithms, encryption keys
    * Check Issues for unresolved vulnerabilities
  </Accordion>

  <Accordion title="Special Findings">
    * `.git` directory exposed → extract source code
    * `.env` file → API keys, DB passwords
    * JS files → use RetireJS to check for known vulnerabilities
    * API endpoints → test for API-specific vulnerabilities
    * 403 Forbidden → try bypass techniques
    * 502 Proxy Error → potential misconfigured proxy/SSRF
    * NTLM Authentication → info disclosure via NTLM challenge
  </Accordion>
</AccordionGroup>

## NTLM Authentication Info Disclosure

```bash theme={null}
# Windows servers with NTLM auth disclose version info
curl -s -I -H "Authorization: NTLM TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=" \
  http://target.com/
# Check WWW-Authenticate header for IIS and Windows version

# Automated with nmap
nmap -p 80,443 --script http-ntlm-info <IP>
```

## Automated Command Reference

```bash theme={null}
# Quick web scan (Nikto + Gobuster)
nikto -host http://<IP>:<PORT> && \
gobuster dir -w <Small_Dirlist> -u http://<IP>:<PORT> && \
gobuster dir -w <Big_Dirlist> -u http://<IP>:<PORT>

# WhatWeb
whatweb -a 4 <IP>

# Nmap web vuln scan
nmap -vv --reason -Pn -sV -p <Port> \
  --script="banner,(http* or ssl*) and not (brute or broadcast or dos or fuzzer)" <IP>

# WordPress
wpscan --url http://<IP>/wp-login.php --enumerate ap,at,cb,dbe && \
wpscan --url http://<IP>/wp-login.php --enumerate u,tt,t,vp --passwords <Big_Passwordlist>

# Ffuf vhost discovery
ffuf -w <Subdomain_List>:FUZZ -u http://<Domain_Name> -H "Host: FUZZ.<Domain_Name>" \
  -c -mc all -fs <common_size>
```

## SSL/TLS Vulnerability Reference

* **No HTTPS enforcement** → MitM possible
* **Sensitive data in HTTP** → high severity
* Check for BEAST, POODLE, HEARTBLEED, ROBOT, DROWN via testssl.sh