Application Discovery & Enumeration

During a penetration test, the scope often includes a large number of hosts. Before attacking individual services, the tester must discover which web applications are running across the environment. This page covers the process: port-based discovery with Nmap, visual enumeration with EyeWitness and Aquatone, and organizing findings.

Asset inventory

Before engaging a target, confirm that all hosts are in scope and document every application found. Even a large network will have a manageable set of web-facing services once common ports are scanned. The goal in this phase is breadth, not depth — find everything, then prioritize.

Nmap web discovery

Port sweep across scope

Scan all hosts in the scope list for common web ports. Use -oA to write Nmap XML, grepable, and normal output simultaneously — later tools (EyeWitness, Aquatone) consume the XML directly.

nmap -p 80,443,8000,8080,8180,8888,10000 --open -oA web_discovery -iL scope_list

Flag	Purpose
`-p 80,443,8000,8080,8180,8888,10000`	Common web ports (HTTP, HTTPS, dev servers, admin panels)
`--open`	Only report open ports — reduces noise
`-oA web_discovery`	Write all output formats with base name `web_discovery`
`-iL scope_list`	Read targets from a file (one IP/CIDR per line)

Service version scan

Once interesting hosts are identified, run a version scan to fingerprint the running services:

nmap --open -sV <TARGET>

Example output showing multiple services on one host:

PORT     STATE SERVICE       VERSION
80/tcp   open  http          Microsoft IIS httpd 10.0
8000/tcp open  http          Splunk httpd
8089/tcp open  ssl/http      Splunk httpd
8080/tcp open  http          Indy httpd 18.1.37.27327 (Paessler PRTG bandwidth monitor)

Services like Splunk and PRTG running on non-standard ports are frequently missed by surface-level scanning and often run with weak or default credentials.

EyeWitness

EyeWitness takes screenshots of web applications, captures server headers, and identifies default credentials. It accepts Nmap XML output directly.

Install

sudo apt install eyewitness

Run against Nmap XML output

eyewitness --web -x web_discovery.xml -d inlanefreight_eyewitness

Flag	Purpose
`--web`	Screenshot HTTP/HTTPS targets
`-x web_discovery.xml`	Nmap XML file as input
`-d inlanefreight_eyewitness`	Output directory

EyeWitness opens an interactive prompt asking whether to scan all hosts from the XML — type Y. Results are written to inlanefreight_eyewitness/report.html.

cat web_discovery.xml | ./aquatone -nmap

-nmap tells Aquatone to parse the input as Nmap XML format.

Interpreting screenshot reports

Both tools produce HTML reports that group targets by category. Key categories to prioritize:

Category	Why it matters
High Value Targets	Default-credential login pages (Tomcat Manager, Splunk, PRTG, Jenkins)
Login pages	Authentication portals — note the software and version for exploitation
Default pages	Servers exposing default install pages — confirms software version, may be misconfigured

Common high-value findings

Apache Tomcat Manager (/manager/html) — default creds tomcat:tomcat, admin:admin, etc.; manager allows WAR file upload → RCE
Splunk — free trial or misconfigured instances may have no auth; Splunk can execute arbitrary commands via search scripts
PRTG Network Monitor — default creds pnrtadmin:prtgadmin; older versions have authenticated RCE CVEs
osTicket — open-source ticketing system; may leak internal email addresses, employee names, and internal URLs useful for phishing or further enumeration
GitLab / Gitea — self-hosted source control; check for public repos, exposed credentials in commit history, or unauthenticated registration

When a screenshot shows a login page, note:

The application and version (from page title, headers, or error pages)
Whether default credentials work
Whether the version has a known CVE

Note-taking structure

Organize findings in a hierarchical structure during the assessment. A format analogous to a OneNote notebook works well:

Client Name
└── Scope
    ├── Web Applications
    │   ├── host: 10.129.x.x
    │   │   ├── app: Apache Tomcat 9.0.x
    │   │   ├── port: 8080
    │   │   ├── creds: tomcat:tomcat (default — valid)
    │   │   └── path to RCE: WAR upload via /manager/html
    │   └── host: 10.129.x.y
    │       ├── app: PRTG 18.1.37
    │       └── CVE: CVE-2018-9276 (authenticated RCE)
    └── Findings
        └── [numbered findings with CVSS scores]

Key fields to capture per application:

Host / IP
Port
Application name and version
URL / path
Authentication status (no auth / default creds / valid creds found)
Notes (interesting endpoints, CVEs, pivot potential)

Keyboard shortcuts

notebook