> For the complete documentation index, see [llms.txt](https://pentest.mxhx.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentest.mxhx.org/02-scanning.md).

# 02 Scan

* Scans:
  * nmap
  * dirb
  * gobuster
  * nikto
  * wp-scan
* Browse:
  * http and https - can be diff
  * ssl certificate details
  * follow links, paths, clues
  * source
  * comments
  * configs
  * robots.txt
  * [apache ](/04-webapps/apache.md)home directories
  * versions
  * login defaults/guessing
  * path/slash/files = [LocalFileInjections](/04-webapps/lfi.md)
  * forms/php = [SQLi ](/04-webapps/03-webapp-sqli.md)or [WebInjections](/04-webapps/03-webapp.md)
* Exploits
  * google 'coldfusion 8 exploits'
  * searchsploit/exploitdb/blogs/github
  * Known: [LFI](/04-webapps/lfi.md) - [SQLi](/04-webapps/03-webapp-sqli.md) - Directory Traversal
  * [EternalBlue](/03-getting-in/eternal-blue.md)/[Shellshock](/04-webapps/03-shellshock.md)/Heartbleed (Well-Known)
  * Remote Code Execution (RCE)
  * CRM/[Wordpress ](/04-webapps/03-webapp-wordpress.md)= Vulns, Addon, Upload, Theme
* Brute:
  * login [hydra](/05-passwords-ciphers/hydra.md)