HTTP

Nmap http scan

nmap -p80,443,8080,8000 \
  --script http-title,http-headers,http-enum,http-methods,http-robots.txt \
  --script-args http-methods.test-all=true \
  -oA http_meta $ip

Files & Dirs Brute Force

gobuster dir -u http://$domain/ \
  -w /usr/share/seclists/Discovery/Web-Content/common.txt \
  -t 50 -o gb_common.txt


ffuf -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt \
     -u http://10.10.10.123/FUZZ -mc 200,204,301,302,307 -t 50 -of csv -o ffuf.csv


dirsearch -u http://10.10.10.123 -e php,html,js,txt -r -t 40 -o dirsearch.txt

Sub-domian Scans

ffuf -u http://$ip -H "Host: FUZZ.mentorquotes.htb" -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-20000.txt -mc 200,301

gobuster vhost -u http://10.10.10.123 -w /usr/share/seclists/Discovery/DNS/namelist.txt -o vhosts.txt

Vuln Scan

nikto -h http://10.10.10.123 -maxtime 1h -o nikto.html

http login bruteforce

hydra -L <user_list.txt> -P <password_list.txt> <target_ip_or_hostname> http-post-form "<login_page_path>:<post_data>:<failure_message>"

hydra -L users.txt -P passwords.txt 192.168.1.10 http-post-form "/login.php:username=^USER^&password=^PASS^&Login=Login:F=Invalid username or password" -V

Wordpress scan

wpscan --url http://10.10.10.123 -e vp,vt,u --api-token $WPS_TOKEN -o wpscan.txt