Practical Web Penetration Testing

Service enumeration

As I mentioned earlier, the application will enumerate the HTTP and FTP services after running the Nmap TCP scan (if the ports are open):

• For FTP enumeration using Nmap, use the following:

nmap_ftp_tool_name = 'NMAP FTP Enum'def execute_nmap_ftp_enum(ip_address, port_number): command = "nmap -sV -p %s --script=ftp* %s" % (port_number, ip_address) return execute_cmd (nmap_ftp_tool_name, command)

• For HTTP, I used Nmap for script scanning and gobuster to find hidden URLs:

nmap_tool_name = 'NMAP HTTP Enum'crawler_tool_name = 'Gobuster'# Description: Execute an Nmap HTTP enum command# Return: The output after command executiondef execute_nmap_http_enum(ip_address, port_number):    command = "nmap -sV -p %s --script=http-enum,http-vuln* ...