# 1. Footprint the Web Infrastructure

## 1. Web Applications recon using Nmap and telnet

```
sudo nmap -vv -A -T4 certifiedhacker.com  //aggressive scan
```

```
telnet certifiedhacker.com 80
```

## <mark style="color:red;">2. Web Applications recon using Whatweb</mark>

```
whatweb -v certifiedhacker.com  //verbose information
```

## 3. Web spidering using ZAP

Launch an automated scan and go to the spidering tab to view pages.

<figure><img src="/files/bFWrdYzanYww2gkr5PJT" alt=""><figcaption></figcaption></figure>

## <mark style="color:red;">4. Detect Load Balancers using various tools</mark>

**dig (you get multiple IPs)**

<figure><img src="/files/6AG9Mv4Y8QN3rskKtmcg" alt=""><figcaption></figcaption></figure>

**lbd**

<figure><img src="/files/MkynED0PqDguEYhC7RqE" alt=""><figcaption></figcaption></figure>

## <mark style="color:red;">5. Identify webserver directories</mark>

{% embed url="<https://youtu.be/S18tDmSIC1E>" %}

**Nmap**

```
nmap -sV --script http-enum certifiedhacker.com
```

**gobuster**

```
gobuster dir -u certifiedhacker.com -w /usr/share/worlists/WORDLIST
```

<figure><img src="/files/WbKZ4y3UhtLYGkPChDoM" alt=""><figcaption></figcaption></figure>

**dirsearch**

{% embed url="<https://www.kali.org/tools/dirsearch/>" %}

{% embed url="<https://www.youtube.com/watch?v=eIrtjfdqAWE&t=12s>" %}
Example dirbusting
{% endembed %}

## <mark style="color:red;">6. Vulnerability scanning using Vega</mark>

{% embed url="<https://subgraph.com/vega/>" %}

## <mark style="color:red;">7. Identify Clickjacking using Clickjackpoc</mark>

{% embed url="<https://github.com/Raiders0786/ClickjackPoc>" %}

```
python3 clickJackPoc.py -f domains.txt \\save domain in a file
```

<figure><img src="/files/Fkc99l7vMjrELMnRLCOx" alt=""><figcaption></figcaption></figure>

## 8. Perform Web Application Vulnerability Scanning using SmartScanner

{% embed url="<https://www.thesmartscanner.com/>" %}

### Best CEH practical Course

{% embed url="<https://www.udemy.com/course/ethical-hacker-practical/?referralCode=289CF01CF51246BCAD6C>" %}


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://ceh-practical.cavementech.com/module-14.-hacking-web-applications/1.-footprint-the-web-infrastructure.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.