> For the complete documentation index, see [llms.txt](https://ceh-practical.cavementech.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ceh-practical.cavementech.com/module-13.-hacking-web-servers/1.-footprint-the-webserver.md). # 1. Footprint the Webserver ## 1. Information gathering using Ghost Eye {% embed url="" %} ``` git clone https://github.com/BullsEye0/ghost_eye.git cd ghost_eye pip3 install -r requirements.txt ``` Now launch it ``` python3 ghost-eye.py ```

We can use the tool for WHOIS lookup, DNS etc and also scan for clickjacking vulnerability ## 2. Perform Web Reconnaisance using skipfish {% embed url="" %} ## 3. Footprint Webserver using Httprecon {% embed url="" %}

## 4. Footprinting using ID serve {% embed url="" %}

## 5. Footprinting using netcat and Telnet ### **netcat** ``` nc -vv certifiedhacker.com 443 GET / HTTP/1.0 ```

### **telnet** ``` telnet certifiedhacker.com 443 GET / HTTP/1.0 ```

## 6. Enumeration Webserver using NSE script ``` nmap -sV --script http-enum certifiedhacker.com ```

Now to enumerate the hostnames use the following script ``` nmap --script hostmap-bft -script-args hostmap.bfk=hostmap- certifiedhacker.com ```

http trace scanner ``` nmap --script http-trace certifiedhacker.com ``` Http WAF (Firewall) detection ``` nmap -p 80 --script http-waf-detect certifiedhacker.com ``` ## 7. Uniscan webserver footprinting {% embed url="" %} ### Best CEHv13 Practical Exam Preparation Course {% embed url="" %}