Web Servers — Hub
Platform-specific enumeration and exploitation once you identify the stack (banner, 404 fingerprint, version, or shell access).
Ctrl+F:
nginx·tomcat·iis·sites-enabled·manager/html·web.config
📌 Identify the stack
| Signal | Likely server |
|---|---|
Server: nginx/x.x | Nginx |
Server: Microsoft-IIS/x.x | IIS |
Port 8080/8443 + Apache-Coyote / Tomcat page | Tomcat |
.aspx / .asp extensions | IIS |
.jsp / /manager/html | Tomcat |
| PHP + reverse proxy errors | Nginx (often fronting PHP-FPM) |
curl -sI http://TARGET | grep -i server
nmap -p 80,443,8080,8443 -sV --script http-server-header TARGETSee UseCases for ports > Port 80 — HTTP · 0xdf — Default 404 Pages · Initial foothold
📌 Notes in this folder
| Note | When |
|---|---|
| Nginx | Linux reverse proxy / PHP front — vhost enum on shell, misconfigs |
| Tomcat | Java — Manager app, WAR upload, JMX, AJP Ghostcat |
| IIS | Windows — web.config creds, short names, app pool privesc |
📌 Cross-cutting web attacks
These apply regardless of server — pair with the platform note above:
| Attack | Note |
|---|---|
| File upload → RCE | File Upload Bypass |
| LFI / path traversal | Local File Inclusion (LFI) |
| SQLi | SQL Injection |
| Default creds | Initial foothold > 📌 1) Default & Weak Credentials |