10.3 Web Mapping Cheatsheet

Need: A reachable HTTP application and recorded anonymous or authenticated request state. Correct scheme/port and virtual host; saved cookies/headers for authenticated comparisons

curl -skL -D headers.txt -o body.html http://TARGET:PORT/
curl -sk -o /dev/null -w 'code=%{http_code} bytes=%{size_download} type=%{content_type} redirect=%{redirect_url}\n' http://TARGET:PORT/

curl -sk -H 'Host: CANDIDATE.DOMAIN' http://TARGET:PORT/

curl -skL -c cookies.txt -b cookies.txt http://TARGET:PORT/PATH

curl -sk -x http://127.0.0.1:8080 http://TARGET:PORT/PATH

Verify: Record final URL, host, status, redirects, cookies and authentication context before comparing payload results.

If it fails: A redirect loop or generic default page may indicate a wrong host or missing session rather than a nonexistent application.

Need: A reachable HTTP application and recorded anonymous or authenticated request state. A normal request baseline and the relevant account/role; authorized accounts for role comparisons

For every visible function, capture one unchanged request in Burp Proxy history, send it to Repeater and record:

METHOD PATH | CONTENT-TYPE | ACCESS CONTEXT/ROLE
INPUT LOCATION + NAME | BASELINE VALUE
STATUS | LENGTH/HASH | REDIRECT | MARKER/ERROR/TIME
OBJECT/FUNCTION SELECTED | NEXT ONE-VARIABLE TEST

Check login/registration/reset, profiles/objects, search/filter/pagination, download/export/preview, upload/import, administration and every JavaScript API call.

Next: a browser-side restriction is not server authorization. Replay the raw request and change one field, object reference, method or access-context element at a time.

Verify: Retain method, route, input location, identity and expected normal behavior; do not infer vulnerability from an interesting parameter name.

If it fails: Expired sessions, CSRF failures and malformed requests can imitate access-control differences; reproduce a valid baseline first.

Need: A reachable HTTP application and recorded anonymous or authenticated request state. Readable application artifact or a complete recoverable repository; preserve the public-source scope

curl -sk http://TARGET:PORT/robots.txt
curl -sk http://TARGET:PORT/sitemap.xml
curl -sk http://TARGET:PORT/.git/HEAD
curl -sk http://TARGET:PORT/openapi.json
curl -sk http://TARGET:PORT/swagger.json

Also inspect HTML comments, hidden inputs, form actions, linked JavaScript, route strings, source-map references, cookies and response headers.

Decisive output: a path, parameter, API schema, object identifier, component or secret-bearing artifact that creates a specific next request. Source disclosure is not command execution.

curl -ski http://TARGET:PORT/.git/HEAD
curl -ski http://TARGET:PORT/.git/config

If authorized, recover into a new local directory with a purpose-built tool and inspect locally:

git-dumper http://TARGET:PORT/.git/ repo-output
git -C repo-output status
git -C repo-output log --oneline --all --decorate
git -C repo-output log -p --all

git-dumper is an optional third-party helper; install on demand in an isolated environment only when the exposure has been confirmed. Manual object recovery is possible but slower.

rg -ni 'password|passwd|token|secret|api[_-]?key|private[_-]?key' repo-output
git -C repo-output log --all -S'password' --oneline
git -C repo-output log --all -G'pass(word)?|secret|token' --oneline

Inspect candidate commits without dumping all history:

git -C repo-output show COMMIT -- PATH
git -C repo-output diff COMMIT^ COMMIT -- PATH

Validate freshness, identity and compatible use. Removed historical values are often rotated or environment-specific.

Verify: Confirm actual file/history content and distinguish a historical secret from a usable current credential.

If it fails: A 200 soft-404 or incomplete object database is not a recovered repository. Compare known-missing paths and record missing history.

Need: A reachable HTTP application and recorded anonymous or authenticated request state. Correct base URL/session and a measured nonexistent-path response; bounded relevant wordlist

Request a random nonexistent path first and record its status, length and body marker.

gobuster dir -u http://TARGET:PORT/ -w /usr/share/wordlists/dirb/common.txt -t 10 -o gobuster-root.txt

gobuster dir -u http://TARGET:PORT/ -w WORDLIST -x php,txt,bak,old,zip -t 10 -o gobuster-ext.txt

gobuster dir -u http://TARGET:PORT/ -w WORDLIST -c 'SESSION=VALUE' -H 'Authorization: Bearer TOKEN' -t 10 -o gobuster-auth.txt

gobuster dir -u http://TARGET:PORT/ -w WORDLIST --exclude-length NOISE_LENGTH -t 10 -o gobuster-filtered.txt

Verify: Open candidates and record their actual behavior; status/length alone is only a selection clue.

If it fails: Aggressive filters can hide genuine routes and rate limiting can fabricate differences; validate the baseline and reduce the request rate.

Need: A reachable HTTP application and recorded anonymous or authenticated request state. A destination listener, relevant domain candidates and controlled Host/SNI routing

gobuster vhost -u http://DOMAIN:PORT/ --append-domain -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -o vhosts.txt

Alternative with automatic calibration:

ffuf -w WORDLIST -u http://TARGET:PORT/ -H 'Host: FUZZ.DOMAIN' -ac -o ffuf-vhosts.json

Verify: Compare candidate and nonexistent-host responses, including content and redirects; resolve to the intended scoped address.

If it fails: A default response for every host or an SNI mismatch makes the result inconclusive; do not treat every guessed hostname as a real application.

Need: A reachable HTTP application and recorded anonymous or authenticated request state. A valid request and explicit role/object ownership; exact input format and content type

GET parameter names:

ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -u 'http://TARGET:PORT/PATH?FUZZ=test' -ac -o params-get.json

POST form parameter names:

ffuf -w WORDLIST -u http://TARGET:PORT/PATH -X POST -H 'Content-Type: application/x-www-form-urlencoded' -d 'known=value&FUZZ=test' -ac -o params-post.json

Object values with an authenticated API:

ffuf -w NUMBERS -u 'http://TARGET:PORT/api/objects/FUZZ' -H 'Authorization: Bearer TOKEN' -mc all -fc 404 -o object-values.json

# HTTPS request, including its original method and session headers
ffuf -request request.txt -request-proto https -w WORDLIST -mc all -ac -t 10 -o request-https.json

# Plain HTTP request: otherwise ffuf defaults to HTTPS
ffuf -request request.txt -request-proto http -w WORDLIST -mc all -ac -t 10 -o request-http.json

curl -ski http://TARGET:PORT/api/v1/PATH
curl -ski -X OPTIONS http://TARGET:PORT/api/v1/PATH
curl -ski -X POST -H 'Content-Type: application/json' -d '{"username":"TEST_USER","password":"TEST_PASSWORD"}' http://TARGET:PORT/api/v1/login

Build a matrix across anonymous, user A, user B and administrator contexts where available:

PATH | METHOD | IDENTITY/ROLE | OBJECT/PROPERTY | RESULT | NEXT

If it fails: HTTP 400/415 may indicate encoding/schema rather than security enforcement. Keep a valid request before changing permissions-related properties.