> ## Documentation Index
> Fetch the complete documentation index at: https://notes.chaelsoo.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Web Enumeration

## Tech Stack Fingerprinting

Identify the backend tech before wordlist fuzzing: knowing it's PHP vs. ASP.NET changes which extensions and paths you prioritize.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
whatweb <URL>
curl -I <URL>
```

## ffuf

Flexible and fast: use it for directories, files, vhosts, and parameter fuzzing. Always set `-fs` or `-fw` to filter out the noise.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Directory fuzzing
ffuf -u http://<IP>/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc 200,301,302,403 -t 50

# File fuzzing
ffuf -u http://<IP>/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-files.txt -e .php,.txt,.html,.bak

# vHost fuzzing
ffuf -u http://<IP>/ -H "Host: FUZZ.<domain>" -w subs.txt -mc 200 -fs <size>

# POST body fuzzing
ffuf -u http://<IP>/login -X POST -d "username=FUZZ&password=test" -w users.txt -mc 200

# Parameter fuzzing
ffuf -u http://<IP>/page?FUZZ=test -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt -mc 200 -fs <size>
```

## CeWL

Crawls a target site and generates a wordlist from the words it finds. More effective than generic wordlists for password spraying and cracking on targets with unique terminology (product names, internal jargon, project names).

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
# Basic: depth 2, min word length 5, save to file
cewl http://$TARGET:$PORT/ -d 2 -m 5 -w cewl_out.txt

# Include numbers in the wordlist
cewl http://$TARGET/ -d 2 -m 5 --with-numbers -w cewl_out.txt

# Extract emails too
cewl http://$TARGET/ -d 2 -m 5 -e -w cewl_out.txt

# With HTTP basic auth
cewl http://$TARGET/ -d 2 -m 5 \
  --auth-type basic --auth-user $USER --auth-pass $PASSWORD \
  -w cewl_out.txt

# With a session cookie (post-login pages)
cewl http://$TARGET/ -d 3 -m 4 \
  -H "Cookie: PHPSESSID=$SESSION_ID" \
  -w cewl_out.txt

# Include words from meta tags (-a) and verbose count
cewl http://$TARGET/ -d 2 -m 5 -a -v -w cewl_out.txt
```

Combine with a base wordlist before cracking or spraying:

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
cat /usr/share/wordlists/rockyou.txt cewl_out.txt | sort -u > combined.txt
```

## gobuster

Good alternative to ffuf for directory and DNS enumeration: simpler syntax when you don't need response filtering.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
gobuster dir -u http://<IP> -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,html,txt -t 50
```

## feroxbuster

Recursively busts directories automatically: useful when you expect deep nested paths and don't want to re-run manually.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
feroxbuster -u http://<IP> -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,html -t 50 --depth 3
```