← Back to Academy

Academy Node

Web Enumeration

Web enumeration identifies technologies, routes, directories, vhosts, parameters, auth portals, upload points, and app behavior.

Beginner100 XPWeb

Why it matters

Web is one of the most common OSCP initial access paths and often feeds credentials into AD.

How to identify it

  • Port 80/443/8080/8000/8443 open
  • Service scan shows HTTP

Linux commands

whatweb http://TARGET
curl -i http://TARGET
nikto -h http://TARGET
feroxbuster -u http://TARGET -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,txt,html,aspx,config,bak -k

Expected output

  • Technology stack
  • Interesting directories
  • Login panels
  • Upload forms

Success looks like

  • Find creds, upload, RCE, LFI, SQLi, admin panel, or source leak

Failure looks like

  • Only static/default page after reasonable enum

Troubleshooting

  • Add hostname to /etc/hosts
  • Check redirects
  • Try HTTPS
  • Look at response headers

Common mistakes

  • Not checking source code
  • Not checking vhosts
  • Not checking default creds

Alternative attacks

  • SMB enumeration
  • LDAP enumeration

What to try next

  • VHost enumeration
  • Feroxbuster
  • Default credentials
  • SQL injection checks
  • File upload abuse

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.