Skip to content
HackIndex.io

OSWA · Module 2

Web Application Enumeration

Fingerprint the stack, crawl and map the app, discover hidden content, endpoints, parameters, and enumerate CMS platforms.

~2 h 12 resources Last updated September 27, 2026

Enumeration is where you spend most of a web application assessment. Before testing any vulnerability class, you need a complete map of the target: the technology stack, every reachable page and endpoint, hidden content, parameters, headers, and cookies. Thorough enumeration turns a black-box target into a known attack surface, and it is the difference between finding one obvious bug and finding the chain that reaches admin.

Fingerprinting and Mapping

Start by identifying what you are dealing with: the web server, framework, language, and any CMS. HTTP headers, response behavior, TLS certificates, and error pages all leak stack details. Crawling the application builds the initial page inventory and surfaces JavaScript files that often reveal endpoints and client-side logic.

Content and Endpoint Discovery

Applications hide functionality behind unlinked paths, virtual hosts, undocumented parameters, and API endpoints. Directory and vhost brute forcing, parameter discovery, and API enumeration expose the routes a crawler misses. Login pages deserve special attention: they reveal the authentication mechanism, username enumeration behavior, and lockout policy that shape later attacks.

CMS Enumeration

When the target runs WordPress, Joomla, or Drupal, dedicated tooling enumerates versions, users, plugins, themes, and exposed configuration far faster than manual probing. A specific CMS and version often maps directly to a known vulnerability, so confirming both is a high-value early step.

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.