> For the complete documentation index, see [llms.txt](https://dhaneshsivasamy07.gitbook.io/oscp-2022/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dhaneshsivasamy07.gitbook.io/oscp-2022/enumeration/http-https.md).

# HTTP/ HTTPS

HTTP and HTTPS services host web services for the servers to host to the end-users. Identify the CMS employed in the web services perform basic testing regarding the CMS and test for web-based attacks, sqli, XXE, SSTI, SSRF, etc..,

## Windows Machine

When the machine hosts an IIS Server always check for its version and check for an open publically available exploits

Use \*-lowercase words to shorten the brute force time

```bash
raft-medium-directories-lowercase.txt from seclists etc..,
```

### Enumeration

* IIS Servers are by defualt vulnerable to tilde enumeration 
* Set to wont fix status by the MSRC Team
* Abusing this reduces the directory enumeration time
* Tool - [IIS-ShortName-Scanner](https://github.com/irsdl/IIS-ShortName-Scanner)

```bash
 java -jar iis_shortname_scanner.jar 2 20 http://url
```

## Linux Machine

Advised to use *feroxbuster* since it enumerates recursively

```bash
feroxbuster -u http://$ip -w /usr/share/wordlists/dirb/big.txt -x php,html,bak,txt,sh  -k 
```