Commit fff4f0f2 authored by bobloblaw's avatar bobloblaw
Browse files

Update web-scanning.md

parent ce2770b6

web-scanning.md

+3 −8
Original line number Diff line number Diff line
@@ -52,15 +52,10 @@ wfuzz -h 
wfuzz -c -z file,/root/.ZAP/fuzzers/dirbuster/directory-list-2.3-big.txt --sc 200 http://pegasus.dev:8088/FUZZ.php

```







## WAF - Web application firewall



It might be that dirb shows you 403 errors, instead of the expected 404. This might mean that there is a WAF protecting the site. To get around it we might have to change our request header to it looks more like a normal request. 



`dirb http://target.com -a "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36"`





### CMS-Scanning 

There are several tools that you can use to scan Content-management-systems for vulnerabilities. These vulnerabilities can be login-bypass, sql-injections, xss, etc.

wpscan
 
 No newline at end of file
 
```

dirb http://target.com -a "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36"

```