I85PREP
⌘ K
eWPT study materials
eWPT study resources

eWPT: Web Application Reconnaissance and Enumeration: Mapping the Attack Surface

eWPT · Work through your exam, one topic at a time.

All guide sections

Web Application Reconnaissance and Enumeration: Mapping the Attack Surface

This domain tests how you discover and map a web application's attack surface without wasting requests. Reconnaissance is passive collection; enumeration is active discovery of hosts, paths, parameters, technologies, and APIs. The exam expects you to turn small clues into testable endpoints and to record how you found them.

Core rules and concepts

  • Start passive: DNS records, certificate transparency logs such as crt.sh, search engines, GitHub, the Wayback Machine, and ASN or netblock data. Then move to active DNS brute force, virtual-host discovery, directory and file enumeration, parameter mining, and technology fingerprinting.
  • Enumeration is iterative. Headers, error pages, redirects, JavaScript bundles, source maps, and robots.txt are all clues. Check /robots.txt, /sitemap.xml, /.well-known/, and common API descriptors such as /swagger.json or /openapi.json.
  • Use a baseline response to filter noise. Compare status code, response length, word count, and redirect target rather than trusting a single 200.
  • Analyse JavaScript for endpoint strings, API versions, parameter names, and client-side secrets. Do not use discovered secrets outside the agreed scope.
  • Prefer targeted wordlists over one giant list, and respect rate limits and WAF behaviour.

Worked example

A target returns 200 for / and a generic 404 for unknown paths. Fetching /static/app.js reveals fetch('/api/internal/users?role=admin'). Requesting it unauthenticated returns 401; replaying with a low-privilege session returns 200 and a user list. The reasoning: the JavaScript disclosed an undocumented API, and the response difference proves the role check is missing. Enumerate adjacent API versions, methods, and parameters before reporting.

Traps that cost marks

  • Relying on a single tool or wordlist and missing virtual hosts that only appear with a correct Host header.
  • Ignoring 401 and 403 responses; they confirm an endpoint exists.
  • Missing alternate ports and non-standard paths such as /api/v2/ and /internal/.
  • Not comparing a baseline 404 against candidate responses, producing false positives.
  • Exceeding scope or triggering rate limits with aggressive brute forcing.