Enumeration Cheat Sheet by imousrf

Gobuster is a tool used to brute-­force:
 ­ ­-URIs (direc­tories and files) in web sites.
 ­ -DNS subdomains (with wildcard support).
 ­ ­-Vi­rtual Host names on target web servers.
DIR mode
To find direct­ories and files.

gobuster dir -u <ur­l> -w <wo­rdl­ist­_fi­le.t­xt> -x <fi­le_­ext­ens­ion­s>

vhost mode
Check if subdomain exists by visiting url and verifying the IP address.

gobuster vhost -v -w <wo­rdl­ist.tx­t> -u <ur­l> -o <ou­tpu­t_f­ile.tx­t>

DNS mode
To find subdomains in a specific domain.

gobuster dns -d <do­mai­n> -w <wo­rd_­lis­t.t­xt> -i

helpfull linux commands
connect to remote host
 

ssh userna­me@­server

Ex.

ssh root@1­92.1­68.1.250

search for files in a directory hierarchy
find file in the current directory
 

find . -name test

find files with certain permission
 

find . -perm 664

search words in file
 

grep "­lit­era­l_s­tri­ng" filename

pipe
you can redirect the output of a command to the input of an other command
 

cat file | wc -l 

get number of lines in file
output redire­ction
you can redirect the output to file
 

echo 'hello there' > file