Web Application Reconnaissance and Enumeration
What the exam tests
Web application reconnaissance on CWES is scoped to discovering the real attack surface before exploitation: hostnames, virtual hosts, content, parameters, APIs, and technology versions. You are expected to move from passive collection to active enumeration without crossing scope.
Core rules and concepts
- Resolve scope first: IPs, domains, wildcards, excluded hosts. Enumerate vhosts by Host header fuzzing when one IP serves many sites.
- Content discovery: use ffuf/feroxbuster/gobuster with extensions (php, aspx, jsp, bak, old, zip, sql), recurse on hits, and calibrate 404s by size/words/hash.
- Read robots.txt, sitemap.xml, security.txt, .git/HEAD, .env, composer.json, package.json, Swagger/OpenAPI, GraphQL introspection, and JavaScript bundles/source maps for endpoints and keys.
- Fingerprint from headers, cookies, error pages, favicon hashes, and default files; version matters because CMS/plugin CVEs are version-specific.
Worked example
A target answers 200 to every path, so status codes are useless. Send a random path and record its body length; configure ffuf with -fs to filter that length and -ac for auto-calibration. A hit returns a different length at /api/v2/users. Fetch it, note JSON, and enumerate methods and parameters; the API reveals an undocumented role parameter. The reasoning is to establish a baseline, filter noise, then expand from confirmed endpoints rather than brute-forcing blindly.
Traps that cost marks
Treating 200 as proof of existence; skipping vhost enumeration; not recursing into discovered directories; ignoring non-standard ports and URL-encoded paths; failing to record requests and responses for the report.