web-enumeration

What problem does it solve?

This skill solves the problem of manually scanning web targets for exposed sensitive files, hidden endpoints, configuration leaks, and cached data that are often overlooked during initial reconnaissance, which can lead to missed high-severity findings and delayed compromise of target systems.

Core Features & Use Cases

• Sensitive File Scanning: Probes 200+ common sensitive file paths (including .env, .git/config, wp-config.php, Dockerfiles, and JavaScript source maps) to identify exposed credentials, configuration data, and source code.
• Path Traversal & Bypass Testing: Tests 10+ common path traversal and encoding bypass techniques to access restricted sensitive files blocked by default server configurations.
• vHost Enumeration: Probes common virtual hostnames to discover hidden internal, staging, or development subdomains that may host exposed assets or weaker security controls.
• Credential & Data Extraction: Automatically extracts database credentials, API keys, JWTs, email addresses, and SQL queries from exposed .env files and application logs for further testing.
• WAF & Access Bypass Guidance: Provides proven techniques to bypass common web application firewalls, 403 access restrictions, and CDN catch-all behaviors that block standard scanning tools.
• Use Case: For a penetration test engagement, use this skill to quickly scan a target's web server for exposed .env files containing database credentials, hidden admin panels, and leaked API keys from JavaScript source maps, cutting initial reconnaissance time from hours to minutes.

Quick Start

Use the web-enumeration skill to scan the target domain https://target.com for exposed sensitive files, path traversal vulnerabilities, and hidden virtual hosts, then extract any credentials found in .env files or application logs.