Hands-On Web Penetration Testing with Metasploit

Enumeration

In the enumeration stage, each and every application, system, or network identified in the previous stage (recon) will be scanned for different attack surfaces—for example, files and directory enumeration in the case of a web application, and ports and services in the case of a network device. This stage will help the tester to identify the attack vectors. An attack vector is a path or method for the attacker to gain access or penetrate the target system; in this case, the pen tester. The most common attack vectors used are phishing emails, malware, and unpatched vulnerabilities.

A pen tester can perform file and directory enumeration, HTTP method enumerations, host enumeration, and a few other enumeration methods to find an ...