Discovering interesting files and directories on various web servers

One of the common tasks during penetration tests that cannot be done manually is file and directory discovery. There are several tools made for this task, but Nmap really shines with its robust database that covers interesting files, such as READMEs, database dumps, and forgotten configuration backups; common directories, such as administration panels or unprotected file uploaders; and even attack payloads to exploit directory traversals in common, vulnerable web applications.

This recipe will show you how to use Nmap for web scanning in order to discover interesting files, directories, and even vulnerable web applications.

How to do it...

Open your terminal and enter the following command:

$ nmap --script http-enum -p80 <target>

The results will include all of the interesting files, directories, and applications:

PORT   STATE SERVICE
80/tcp open  http
| http-enum:
|   /blog/: Blog
|   /test.php: Test page
|   /robots...