Web Application Reconnaissance

Relax. We'll talk through this in plain words — no textbook voice.

What you'll walk away with

Understand Web Application Reconnaissance without the intimidation factor
Get hands-on running tools yourself in an authorized lab environment
Be ready to apply this concept directly in a real assessment/report

Let's think about this for a moment

Directory enumeration means systematically searching a web server for hidden/undocumented paths (`/admin`, `/backup`, `/.git`) using a wordlist — this is how you can find an admin panel or backup file that a developer forgot to remove from production. Technology fingerprinting means estimating a website's underlying technology (framework, CMS, server software) from HTTP headers, HTML source, and error messages — knowing it's WordPress, or a specific framework version, is what lets you target known vulnerabilities.

Let's connect it to a real scenario

Run `gobuster dir -u http://192.168.56.101 -w wordlist.txt` against a lab web app and it can auto-discover hidden paths like `/admin`, `/uploads`, and `/.git` — finding `/.git` means you can potentially download the entire source code repository (a real risk when developers forget to remove the `.git` folder before deploying to production). The `whatweb` tool can auto-detect a target's CMS/framework/server software.

Directory enumeration = searching for hidden/undocumented paths using a wordlist
Technology fingerprinting = estimating a website's underlying framework/CMS/server
Leaving a hidden path like /.git in production is a common real-world mistake

Let's look at an example together

bash

# Directory enumeration (against your own lab web app)
gobuster dir -u http://192.168.56.101 -w /usr/share/wordlists/common.txt

# Technology fingerprinting
whatweb http://192.168.56.101

# Check for an exposed .git directory
curl -s http://192.168.56.101/.git/config

You should see

===============================================================
/admin                (Status: 200)
/uploads              (Status: 301)
/backup.zip           (Status: 200)

Try it in 5 minutes

Run directory enumeration against your lab web app (DVWA or the Metasploitable web app) using `gobuster` or `dirb` — review the resulting path list and guess which paths an attacker would find most interesting.

A quick word of caution

Running directory enumeration at an aggressive request rate against a production server, even with authorization, can create a DoS-like effect if you don't rate-limit it — adjust the request rate to keep server load under control.

Easy traps

Picking a wordlist that's too large without factoring in the authorization scope/testing window — the scan can take too long and blow past your testing window
Assuming directory enumeration results are 'the complete picture' — paths that aren't in your wordlist can still exist (it's never fully comprehensive)

Now try it yourself

You'll know it worked when: =============================================================== /admin (Status: 200) /uploads (Status: 301) /backup.zip (Status: 200)