Skip to content
HackIndex.io

HTTP/HTTPS:

Enumeration

HTTP enum covering fingerprinting, vhosts, dirs, APIs, CMS, and headers

13 guides • Created Dec 28, 2025 • Updated Mar 29, 2026
13 guides

API Endpoint Enumeration

Discover hidden API endpoints via fuzzing, path traversal, JS analysis, and spec file leakage to map attack surface on HTTP/HTTPS services.

Mar 28, 2026 • 6 min read

Burp Suite

Intercept, inspect & manipulate HTTP/HTTPS traffic using Burp Suite's proxy, scanner & repeater for web app enumeration and vulnerability discovery.

Sep 14, 2026 • 4 min read
CMS Detection and Fingerprinting

CMS Detection and Fingerprinting

Identifies CMS platforms (WordPress, Joomla, Drupal) via HTTP responses, meta tags, file paths, and headers to map attack surface during web enumeration.

Mar 28, 2026 • 8 min read

Web Content Discovery

Techniques for discovering hidden files, directories, and endpoints on web servers using fuzzing tools, wordlists, and response analysis.

Jan 23, 2026 • 8 min read

Drupal enumeration

Techniques for enumerating Drupal CMS installations, including version detection, module discovery, user enumeration, and identifying misconfigurations via droopescan and manual methods.

Jan 23, 2026 • 5 min read

HTTP Header Analysis

Analyze HTTP response headers to identify server technologies, security misconfigurations, and information disclosure vulnerabilities during web enumeration.

Mar 28, 2026 • 4 min read

HTTP Tech Fingerprinting

Identify web technologies, frameworks, servers & versions via HTTP headers, cookies, error pages, and tool-based analysis to map attack surface.

Jan 23, 2026 • 5 min read

Login Page Enumeration

Identifies valid usernames & accounts via login page responses, error messages, timing differences, and behavioral analysis on web authentication endpoints.

Mar 28, 2026 • 7 min read

Virtual Host Enumeration

Discover hidden virtual hosts on web servers by fuzzing Host headers, identifying subdomains and concealed services sharing the same IP address.

Jan 23, 2026 • 5 min read

Web Crawling and Spidering

Systematically map web application structure by discovering pages, directories, and endpoints through automated crawling and link analysis.

Sep 13, 2026 • 6 min read

WordPress Enumeration

Enumerate WordPress installations by identifying versions, plugins, themes, and users via WPScan, manual probing, and API endpoints.

Jan 23, 2026 • 5 min read

Web enumeration is the active discovery phase where you map out the target's web attack surface. Directory and file brute-forcing with feroxbuster, gobuster, or dirsearch reveals hidden endpoints, admin panels, backup files, and development artifacts that the application was never meant to expose.

Beyond directory busting, this phase covers virtual host enumeration to find subdomains served on the same IP, technology fingerprinting with Wappalyzer and WhatWeb, CMS detection for WordPress/Joomla/Drupal, and API endpoint mapping through wordlist fuzzing and documentation leaks like Swagger/OpenAPI files.

Start here to build a complete picture of the web surface before testing individual vulnerabilities. The difference between a shallow assessment and a thorough one is almost always the quality of enumeration.