Active Recon

1. Add domain to /etc/hosts file
2. Run directory/page brute force discovery
   • [ ] First fuzz for extension
     • [ ] If extension is discovered then fuzz for directories and other pages with extension appended
3. Look in robots.txt for hidden endpoints
4. Run subdomain and vhost brute force discovery
5. Look for comments in HTML pages
6. Look for vulnerabilities in Web server technologies being used
   • [ ] Use nikto to scan the web server
   • [ ] Scan the webserver with NMAP discovery scripts
7. Look for web service versions on discovered page
   • [ ] Look for CMS
8. Look for Vulnerabilities in discovered web service versions
   • [ ] Search metasploit
   • [ ] Search ExploitDB