Web enumeration

Wordlist paths are the SecLists ones on Kali and Parrot (/usr/share/seclists). Use -fs or -fw to filter responses by size or word count.

Your values Saved in this browser and applied to every cheatsheet.

Fuzzing

Fingerprinting

whatweb 
whatweb http://box.htb
Response headers 
curl -sI http://box.htb

Directories and files

Directories with ffuf 
ffuf -u http://box.htb/FUZZ -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -ic -t 100
Files with extensions 
ffuf -u http://box.htb/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -e .php,.txt,.bak,.zip -ic -t 100
gobuster 
gobuster dir -u http://box.htb -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -x php,txt -t 50
Recursive with feroxbuster 
feroxbuster -u http://box.htb -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt

Subdomains and vhosts

Vhosts with ffuf 
ffuf -u http://10.10.11.20 -H 'Host: FUZZ.box.htb' -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs 0

Run it once, note the default response size and filter it out with -fs.

Vhosts with gobuster 
gobuster vhost -u http://box.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt --append-domain
Add the subdomain to /etc/hosts 
echo '10.10.11.20 box.htb dev.box.htb' | sudo tee -a /etc/hosts

Parameters

GET parameter names 
ffuf -u 'http://box.htb/index.php?FUZZ=test' -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fs 0
POST values 
ffuf -u http://box.htb/api/user -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'id=FUZZ' -w ids.txt -fs 0
Generate numbers for IDOR 
seq 1 1000 > ids.txt

Common findings

Exposed source code

Dump an exposed .git 
git-dumper http://box.htb/.git/ repo
Review the history 
cd repo && git log --oneline && git show HEAD~1
Search secrets in every commit 
git log -p | grep -iE 'pass|secret|token|key'

CMS

WordPress 
wpscan --url http://box.htb -e ap,u --plugins-detection aggressive
Joomla 
joomscan -u http://box.htb
Drupal version 
curl -s http://box.htb/CHANGELOG.txt | head

Login brute force

HTTP form with hydra 
hydra -l admin -P /usr/share/wordlists/rockyou.txt box.htb http-post-form '/login.php:user=^USER^&pass=^PASS^:F=incorrect'

The text after F= is something that only appears when the login fails.

Basic auth 
hydra -L users.txt -P passwords.txt box.htb http-get /admin
SSH 
hydra -l root -P /usr/share/wordlists/rockyou.txt ssh://10.10.11.20 -t 4