Mastering Kali Linux for Web Penetration Testing

Touring the target environment

Local copies allow us to scope out the site in a safe manner, but where do we start? Manual hands-on scanning will help us understand the flow and give us some hints as to the next steps. I would first recommend getting a feel for the site's hierarchy and where various dynamic content portals may reside. Where can users log into the applications hosted there, query for information, or provide or view feedback? We should also be making note of entity information that we can use later to enumerate names, e-mail addresses, and organization information, and better understand inter-entity relationships. If we are repurposing this mirror for MITM or honeypot duties, we'll want to be able to replicate not only the ...