Wordlist Scanning
Sub-technique of T1595 Active Scanning ↗
Trying thousands of paths, files, subdomains or parameters from a wordlist to find what is not linked anywhere.
How it shows up on Hack The Box
It is the first step in almost every box with a website: an admin panel at /admin, a dev. vhost or a forgotten API endpoint. Use SecLists wordlists and filter by response size to remove false positives.
Techniques in our catalog that match this one (the number is their machines):
Machines to practice it
Sorted from easiest to hardest. The ▶ link takes you to the minute of the IppSec video where it is used.
Showing 48 of 92. Open each catalog technique above to see them all.
Guides
- Web fuzzing: directories, extensions, subdomains and vhosts with ffuf, gobuster and feroxbuster 3 min read Find hidden paths, backups, vhosts and exposed .git repos with ffuf and gobuster: which wordlist to use and how to filter out false positives.
- IDOR, mass assignment and APIs: the access control flaws scanners miss 3 min read Enumerate an API (Swagger, hidden routes, versions), find IDORs by changing IDs, become admin with mass assignment and test access control with two users.
Commands
Taken from our cheatsheets and tool pages. Type your details and they are filled into every command.
Your values
Saved in this browser and applied to every cheatsheet.
Web enumeration › Fuzzing
Directories with ffuf
ffuf -u http://box.htb/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -ic -t 100
Files with extensions
ffuf -u http://box.htb/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -e .php,.txt,.bak,.zip -ic -t 100
gobuster
gobuster dir -u http://box.htb -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,txt -t 50
Recursive with feroxbuster
feroxbuster -u http://box.htb -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
Vhosts with ffuf
ffuf -u http://10.10.11.20 -H 'Host: FUZZ.box.htb' -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs 0Run it once, note the default response size and filter it out with -fs.
Vhosts with gobuster
gobuster vhost -u http://box.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain
GET parameter names
ffuf -u 'http://box.htb/index.php?FUZZ=test' -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fs 0
POST values
ffuf -u http://box.htb/api/user -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'id=FUZZ' -w ids.txt -fs 0Nmap and service enumeration › Nmap
Web path fuzzing with nmap
nmap --script http-enum -p80 10.10.11.20feroxbuster › Useful options
With extensions and without 404s
feroxbuster -u http://box.htb -x php,txt -C 404
Limit the depth
feroxbuster -u http://box.htb --depth 2
Drop responses of a given size
feroxbuster -u http://box.htb -S 1234
Send it through Burp
feroxbuster -u http://box.htb --proxy http://127.0.0.1:8080 -kffuf › Filters and tricks
Drop responses of a given size (false positives)
ffuf -u http://box.htb/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -fs 1234
Only some status codes
ffuf -u http://box.htb/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc 200,204,301,302,403
Recursive
ffuf -u http://box.htb/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -recursion -recursion-depth 2
From a request saved in Burp
ffuf -request peticion.txt -request-proto http -w /usr/share/seclists/Fuzzing/special-chars.txtPut FUZZ wherever you want to test inside the request file.
Slower (if the site falls over or blocks you)
ffuf -u http://box.htb/FUZZ -w lista.txt -rate 50 -t 10Gobuster › Useful options
With extensions
gobuster dir -u http://box.htb -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -x php,txt,bak
HTTPS with a self-signed certificate
gobuster dir -u https://box.htb -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -k
Ignore responses of a given size
gobuster dir -u http://box.htb -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt --exclude-length 0
Subdomains over DNS
gobuster dns -d box.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
Vhosts appending the domain to each word
gobuster vhost -u http://box.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domainNmap › Beyond the basics
Show the help of an NSE script
nmap --script-help http-enumNo command matches.