> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/enumeration/http.md). # HTTP **HTTP IIS** * Most common protocols ae HTTP. * We would see this on an External and Internal Scan. Websites are a big part of the internet. ``` nmap -sV -O ``` * Open browser and navigate to the target ip address. **WhatWeb** ``` whatweb ``` * Its going to find some information about the website ``` http ``` * it show header information. **Dirb** ``` dirb ``` * Dirb enumerates the sites directories and files. **Browsh** ``` browsh --startup-url http:/// ``` * It will do website enumeration based on a URL in your command line ### HTTP IIS Nmap Scripts * similar to running dirb ``` nmap -p80 --script http-enum ``` * information related to headers ``` nmap -p80 --script http-headers ``` * Information about the supported methods ``` nmap -p80 --script http-methods --script-args http-methods.url-path=/webdav/ ``` * webdav-scan - identify WebDAV installations, utilizing options and pop-line methods. ``` nmap -p80 --script http-webdav-scan --script-args http.methods.url-path=/webdav/ ``` ### HTTP Apache * To enumerate the version of the website ``` nmap -sV -p80 --script banner ``` ``` msfconsole -q > use auxiliary/scanner/http/http_version > set rhosts > exploit ``` ``` curl | more ``` ``` wget http:/// ``` ``` browsh --startup-url ``` **lynx** ``` lynx http:/// ``` ``` msfconsole -q > use auxiliary/scanner/http/brute_dirs > set rhosts > exploit ``` ``` dirb http:/// /usr/share/metasploit-framework/wordlists/directory.txt ``` * check **robots.txt** ``` msfconsole -q > use auxiliary/http/robots_txt > set rhosts > run ``` ``` curl http:///cgi-bin | more ``` * We have a 404, knowing that CGI-bin exists might be helpful. This case got 403 forbidden that could be potentially useful later for exploitation or for auditing.