Recon
Part of 01 Web in the Web Application Testing Cheatsheet.
Reconnaissance is the first phase of any web engagement: identify the stack, the ports, the virtual hosts, and any protection layer - before sending a single exploit. The files below cover the four pillars of web recon and are meant to be read in the order listed.
Files
| File | Description |
|---|---|
| Fingerprinting.md | Passive and active stack identification: headers, cookies, favicon hash, WAF signals. |
| Ports-Services.md | Common HTTP and database ports, what runs on them, and where to go next. |
| VHosts-Subdomains.md | Virtual host and subdomain enumeration to find admin panels, staging, and forgotten services. |
| WAF-Detection.md | Automated and manual WAF detection, vendor fingerprints, and how to adapt when a WAF is present. |
See 01 Web README for the full subcategory map.