This skill is the standard first step of a penetration test, with the goal of discovering as many assets and vulnerabilities as possible starting from a domain/IP.
In-depth reference
- Web directories, historical endpoints, hidden parameters, Next.js/SPA route discovery → references/web-discovery-methods.md
Phase 0: Scope confirmation
Confirm the scope of the test target and the task description, and try not to exceed the target scope
- If the task emphasizes not testing subdomains, skip the Phase 1: subdomain enumeration step
- If the task emphasizes not testing other ports, skip the Phase 2: port scanning step
Phase 1: Subdomain enumeration
Use DNS enumeration tools to obtain more subdomains. This step is critical—subdomains are often forgotten attack surfaces (test environments, old versions, internal systems).
Recommended tools
- ksubdomain
Analysis points：
- Subdomain naming patterns:
dev.,test.,staging.,api.,admin.are usually high-value targets - CDN distribution: domains protected by CDN may require finding the origin server IP
- Wildcard records:
*.example.comwhen present, dictionary enumeration is needed rather than pure DNS resolution
Phase 2: Port scanning
Use port scanning tools to scan ports on the discovered IPs/domains.
Recommended tools
- naabu
High-value ports：
- Web：80, 443, 8080, 8443, 8888
- Databases: 3306(MySQL), 5432(PostgreSQL), 6379(Redis), 27017(MongoDB)
- Remote management: 22(SSH), 3389(RDP), 5900(VNC)
- Middleware: 8009(AJP/Tomcat), 9200(Elasticsearch), 2375(Docker API)
Recommendations
- If scanning determines that the target has no open ports, it is recommended to use a full port scan (1-65535)
- Unless there really are no tools available, it is not recommended to use nmap; it is too slow and the results are too poor
Phase 3: Liveness detection
Use the urlive liveness probing tool to detect the liveness status of HTTP/HTTPS services.
Recommended tools
- httpx
Analysis points：
- HTTP to HTTPS redirect chain
- Different ports return different applications (multiple sites on the same IP)
- Endpoints with status codes 403/401 → may be admin backends requiring authentication
- 302 redirect to login page → indicates protected content
Phase 4: Fingerprinting
Use fingerprinting tools to identify the technology stack, which directly determines the direction of subsequent vulnerability exploitation.
Recommended tools
- nuclei
Technology stack → attack strategy mapping：
| Technology stack | Priority checks |
|---|---|
| PHP | LFI/file upload/deserialization |
| Java/Spring | Deserialization/JNDI/Actuator |
| Python/Django/Flask | SSTI/Pickle |
| Node.js/Express | Prototype pollution/SSRF |
| WordPress/Joomla | CMS-specific POCs |
| Nginx/Apache | Parsing vulnerabilities/misconfigurations |
Phase 5: POC scanning
Use vulnerability scanning tools to scan for known vulnerabilities. Focus on specific vulnerability categories based on fingerprinting results.
Recommended tools
- nuclei
Common vulnerability types
- Framework vulnerabilities (Spring4Shell, Struts2, Log4j)
- CMS vulnerabilities (WordPress plugin, Joomla, Drupal)
- Middleware vulnerabilities (Tomcat Manager, WebLogic, JBoss)
Output requirements
After each phase, briefly summarize the findings, and finally sort by attack priority:
- Directly exploitable high-risk vulnerabilities
- Exposed management backends and sensitive interfaces
- Attack surface that can be further probed