Web enumeration & exploitation arsenal

Authorized, in-scope targets only. Add target.tld to /etc/hosts first; many apps only respond to their vhost name, not the raw IP.

1. Fingerprint (what am I looking at)

whatweb — fastest first look; identifies CMS/server/framework in one shot. whatweb -a3 http://target.tld — -a3 = aggressive plugins (more detail, more requests). httpx — best for triaging many hosts/vhosts at once. httpx -title -tech-detect -status-code -u http://target.tld — title + tech stack + code. curl — ground truth; no interpretation between you and the bytes. curl -sI http://target.tld — -s silent, -I headers only (Server, redirects, cookies). curl -s -H 'Host: dev.target.tld' http://target.tld/ — hit a vhost without editing hosts. Gotcha: -I sends HEAD; some apps 405/behave differently — use curl -s ... -o /dev/null -D - for a real GET with headers. Wappalyzer — browser extension; confirms JS frameworks curl can't see rendered. nikto — noisy misconfig/known-file scanner; good on legacy targets, useless stealth. nikto -h http://target.tld — Gotcha: hammers the server; run once, not in a loop.