> For the complete documentation index, see [llms.txt](https://tenaka.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://tenaka.gitbook.io/pentesting/enumeration/nmap/web.md).

# Web

nmap -sV --script http-enum 10.2.23.197 -p80

nmap -sV --script http-headers -p80 10.2.23.197

nmap --script http-methods --script-args http-methods.url-path='/webdav/' IP

nmap --script http-webdav-scan --script-args http-methods.url-path='/webdav/' IP

#### accessible folders 

Nmap --script http-enum -p80,443 IP

#### change root dir 

Nmap --script http-enum -script-args http-enum.basepath=/mantis2.3.0/ -p80 

#### enum users 

Nmap -80 --script http-userdir-enum IP

#### account and password guessing 

Nmap -80 --script http-brute IP

Nmap -80 --script http-brute --script-args userdb=/var/username.txt,passdb=/var/passwords.txt 

#### IP check out other options Nmap -80 --script http-wordpress-brute IP

Nmap -80 --script http-joomla-brute IP

#### id's IDS and Fw's 

Nmap -80 --script http-waf-detect,http-waf-fingerprint IP

#### XSS vulns - lots more options for this 

Nmap -80 --script http-unsafe-output-escaping IP

#### check online db for xss vulns 

Nmap -80 --script http-xssed IP

####

#### check for default creds Nmap -80 --script http--default-accounts IP