Enumerate a web root you filled, and read the status codes right

short · 50 min · Objective 2.2

Task

Enumerate content on a web server you built, having first hidden a few things in it, and calibrate against a soft 404 so your hits are real. The naive rule "200 means it exists" fails immediately, and this lab is where you see why.

Steps

  1. On a VM on the lab network you own, run a web server and plant a few things: an unlinked admin path, a backup file with a .bak suffix, and a directory that returns 403.
  2. Configure the server so that a missing path returns 200 with a "not found" page — a soft 404 — so you have to calibrate.
  3. From the attacker VM, request a path that certainly does not exist and record what the server does, so you know the baseline to filter against.
  4. Run a directory and content enumeration with a wordlist plus extensions, saving results to /tmp/enum.txt.
  5. Filter by response size and content, not status alone, and confirm you found the planted admin path and backup file.
  6. Record which status codes were hits: 401, 403, 405 and redirects all confirm a resource exists.

Verify

awk '{print $2}' /tmp/enum.txt | sort | uniq -c
grep -ciE "\.bak|backup|admin" /tmp/enum.txt
grep -cE "\b(301|302|401|403|405)\b" /tmp/enum.txt

The first line shows the distribution of status codes seen. The second must be non-zero: you found the backup or admin path you planted, which is the exercise working. The third must be non-zero: a run that only counted 200s as hits missed the redirects and access-denied responses that confirm a resource is there — and against a soft-404 server, naive status logic finds nothing but noise.

Notes

Version control directories and backups in the web root are among the highest- value web findings and need no exploit — a .git directory can reconstruct the whole repository, credentials and all. Enumeration is thousands of requests, so watch response times: a server slowing under the load is a warning, and continuing through it is how you cause the outage. Everything here ran against a server you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.