Fingerprinting Web Servers with Nmap
Nmap is the go-to tool for initial active enumeration.
We should start web application enumeration from its core component,
the web server,
since this is the common denominator of any web application
that exposes its services.
Since we found port 80 open on our target,
we can proceed with service discovery.
To get started, we’ll rely on the nmap service scan
to grab the web server banner.
Our scan shows that Apache version 2.4.41
is running on the Ubuntu host.
To take our enumeration further,
we’ll use service-specific Nmap NSE scripts,
like http-enum,
which performs an initial fingerprinting of the web server.
We discovered several interesting folders
that could lead to further details about the target web application.