# HTTP/HTTPS

> HTTP/HTTPS pentesting covers recon, enum, vuln discovery, and exploitation of web apps via XSS, SQLi, RCE, LFI, SSRF, JWT flaws, file uploads, and more through to exfil and persistence

- **URL:** https://hackindex.io/services/web
- **Type:** Service
- **Default ports:** 80, 443
- **Tags:** web, http, https, api, network, reconnaissance
- **Published:** 2025-12-31
- **Updated:** 2026-07-14

HTTP and HTTPS are the foundation of web services, running on **TCP port 80** (HTTP), **TCP port 443** (HTTPS), and common alternates like **TCP 8080** and **8443**. Nmap identifies them as `http` and `https` (or `http-proxy`, `https-alt`). Web servers include Apache, Nginx, IIS, and many application frameworks that serve HTTP directly.

Web services present the largest attack surface on most targets. Server misconfigurations, exposed admin panels, default credentials, directory listings, and outdated software are common findings. Application-level vulnerabilities like SQL injection, XSS, SSRF, and file inclusion extend the surface further.

Start with technology fingerprinting (Wappalyzer, WhatWeb), then enumerate directories and files with tools like `feroxbuster` or `gobuster`. Check for virtual hosts, review TLS certificates for hostnames, and inspect HTTP headers and response codes. Examine the application logic for authentication bypasses and injection points.

## Phases

- [Reconnaissance](https://hackindex.io/services/web/reconnaissance.md): Subdomain brute force, passive recon, cert logs, and dorks (4 guides)
- [Enumeration](https://hackindex.io/services/web/enumeration.md): HTTP enum covering fingerprinting, vhosts, dirs, APIs, CMS, and headers (13 guides)
- [Vulnerability Discovery](https://hackindex.io/services/web/vulnerability-discovery.md): Web vuln checks: XSS, SQLi, SSRF, XXE, IDOR, JWT, and more (29 guides)
- [Exploitation](https://hackindex.io/services/web/exploitation.md): RCE, SQLi, XSS, LFI, SSRF, XXE, JWT, file upload and more (49 guides)
- [Post-Exploitation](https://hackindex.io/services/web/post-exploitation.md): Web shell management, upgrades, and config credential harvesting (2 guides)
- [Lateral Movement](https://hackindex.io/services/web/lateral-movement.md): Pivot from web servers to internal nets via proxies and tunneling (1 guides)
- [Data Exfiltration](https://hackindex.io/services/web/data-exfiltration.md): HTTP exfil via curl, SQLi, and out-of-band DNS channels (3 guides)