Penetration Testing #3

It's always good to know which applications are installed on a server before trying to exploit it.  Many applications already have existing vulnerabilities  and other applications are not updated by the company for various reasons.  Due to virtual web servers, many websites are hosted under one IP address. This means that to access a certain application, you would have to go through the DNS name rather than the numeric IP.  Finding all the web applications on a web server through whatever means is the definition of web application discovery.

Once we are given a target (a DNS name or IP address), there are three factors that influences finding  applications that are hosted on that target. First factor is a Different Base URL. The base URL is the target given to us (the DNS name). So if our target is http://google.com, the base URL is google.com, but what if the application is hosted on http://google.com/app1/?  Secondly, the use of non-standard ports. By default, people use port 80 for web servers , however what happens if people start using random ports? Lastly, we have the idea of virtual hosts.  That is, multiple domains pointing to one IP Address.  So, how do we find solutions for the above situations?

It's difficult to find applications if they are installed somewhere other than the base URL. The best way to find is through search engines (if application is on the internet) or through intelligent guessing (for example, a mail application could be installed in a directory called 'mail').  If an application is ran on a non-standard port, we can easily find it through running a port scanner like nmap. Lastly, the best way to combat the virtual host setup would be using a reverse IP tool such as the one provided by domaintools.com. The reverse IP tool works by just entering an IP address and it tries to list all the domains hosted on that IP address.