eWPTv2
GitHubPortfolioTwitter/XMediumCont@ctHome
  • 📝eWPTv2
    • 1️⃣​1 - Introduction to Web App Security Testing
      • 1.1 Web Application
      • 1.2 Web App Architecture
      • 1.3 HTTP/HTTPS
      • 1.4 Web App Pentesting Methodology
    • 2️⃣2 - Web Fingerprinting and Enumeration
      • 2.1 Information Gathering
        • 2.1.1 DNS Recon
          • 2.1.1.1 DNS Zone Transfer
          • 2.1.1.2 Subdomain Enumeration
        • 2.1.2 WAF Recon
      • 2.2 Passive Crawling & Spidering
      • 2.3 Web Server Fingerprinting
        • 2.3.1 File & Directory Brute-Force
    • 3️⃣3 - Web Proxies
      • 3.1 Burp Suite
      • 3.2 OWASP ZAP
    • 4️⃣4 - Cross-Site Scripting (XSS)
      • 4.1 XSS Anatomy
      • 4.2 Reflected XSS
      • 4.3 Stored XSS
      • 4.4 DOM-Based XSS
      • 4.5 Identifying & Exploiting XSS with XSSer
    • 5️⃣5 - ​SQL Injection (SQLi)
      • 5.1 DB & SQL Introduction
      • 5.2 SQL Injection (SQLi)
      • 5.3 In-Band SQLi
      • 5.4 Blind SQLi
      • 5.5 NoSQL
      • 5.6 SQLMap
      • 5.7 Mitigation Strategies
    • 6️⃣6 - ​Common Attacks
      • 6.1 HTTP Attacks
        • 6.1.1 HTTP Method Tampering
        • 6.1.2 Attacking HTTP Authentication
      • 6.2 Session Attacks
        • 6.2.1 Session Hijacking
        • 6.2.2 Session Fixation
        • 6.2.3 Session Hijacking via Cookie Tampering
      • 6.2 CSRF
      • 6.3 Command Injection
    • 7️⃣7 - ​File & Resource Attacks
      • 7.1 File Upload Vulnerability
      • 7.2 Directory Traversal
      • 7.3 File Inclusion (LFI and RFI)
        • 7.3.1 Local File Inclusion (LFI)
        • 7.3.2 Remote File Inclusion (RFI)
    • 8️⃣8 - CMS Pentesting
      • 8.1 - Wordpress & Drupal
    • 9️⃣9 - Encoding, Filtering & Evasion
      • 9.1 - Obfuscating attacks using encodings
    • 📄Report
      • How to write a PT Report
  • 🛣️RoadMap / Exam Preparation
  • 📔eWPT Cheat Sheet
Powered by GitBook
On this page
  • File and Directory Enumeration
  • Gobuster​
  • BurpSuite​
  • Dirb
  • Other Tools
  1. eWPTv2
  2. 2 - Web Fingerprinting and Enumeration
  3. 2.3 Web Server Fingerprinting

2.3.1 File & Directory Brute-Force

Previous2.3 Web Server FingerprintingNext3 - Web Proxies

Last updated 1 month ago

File and Directory Enumeration

​

​ - a tool used to brute-force URIs including directories and files as well as DNS subdomains.

​

​ - an integrated platform for performing security testing of web applications.

- a tool to brute force URIs, more similar to Gobuster

Other Tools

In addition, we can use Nmap nse-scripts, WeFuzz and custom script with the help of a strong dictionary.

📝
2️⃣
Gobuster
Gobuster
BurpSuite
BurpSuite
Dirb
Dirb
Gobusterhttps://www.kali.org/tools/gobuster/
Burp Suitehttps://portswigger.net/burp https://www.kali.org/tools/burpsuite/ https://tryhackme.com/room/burpsuitebasics
Dirbhttps://www.kali.org/tools/dirbuster/