A hands-on penetration testing lab documenting the enumeration of HTTP/HTTPS services on a Metasploitable 2 target — covering service/version discovery, directory & hidden-file brute-forcing, and automated vulnerability scanning.
Web services (ports 80/443) are one of the largest attack surfaces on any network. Before exploitation, a pentester must thoroughly enumerate what a web server is exposing — software versions, hidden directories, backup files, and misconfigurations. This repository documents that exact process against a deliberately vulnerable lab machine, as part of my hands-on penetration testing practice.
- Identify the web server software, version, and technologies in use
- Discover hidden directories and files not linked from the main site
- Run an automated vulnerability scan against the discovered web service
- Document findings in a clear, repeatable methodology
| Component | Details |
|---|---|
| Attacker Machine | Kali Linux |
| Target Machine | Metasploitable 2 (intentionally vulnerable VM) |
| Network | Isolated NAT / Host-only lab network |
| Services Tested | HTTP (80) / HTTPS (443) |
⚠️ This lab was performed entirely on machines I own and control, on an isolated virtual network created for educational purposes.
- Nmap — service/version detection and initial port enumeration
- Dirb / Gobuster — directory and hidden-file brute-forcing
- Nikto — automated web server vulnerability scanning
Ran an Nmap scan against the target to identify open web ports, the web server software, and running technologies.
2️⃣ Directory & Hidden File Enumeration
Brute-forced the web root to uncover hidden directories, admin panels, and files not referenced anywhere on the visible site.
Used Nikto to scan the discovered web service for outdated software, dangerous files, misconfigurations, and known vulnerabilities.
- Web server software and version were successfully fingerprinted via Nmap
- Multiple hidden directories/files were exposed via brute-force enumeration that were not linked from the site's navigation
- Nikto flagged outdated components and common misconfigurations typical of the Metasploitable environment
- Practical, repeatable workflow for HTTP/HTTPS enumeration during the reconnaissance phase of a penetration test
- Hands-on experience correlating Nmap, directory brute-forcing, and Nikto output to build a full picture of a web attack surface
- Reinforced the importance of enumeration before attempting exploitation
This project was conducted strictly in a personal, isolated lab environment against Metasploitable 2, a machine intentionally built for security training. All techniques shown here are for educational purposes only. Do not use these methods against any system you do not own or do not have explicit written authorization to test.
Mehedi Hasan Sami Junior Penetration Tester | BlackHawk & BlackVault Security Teams CEH · CCNA · NSDA Penetration Testing L4 · Certified Phishing Prevention Specialist
- GitHub: @mehedi-hasan-sami98
This project is licensed under the MIT License.