Web Reconnaissance

Workspace Preparation

workspace create web-recon
workspace use web-recon
scope add 127.0.0.1
host add 127.0.0.1 --note "authorized local target"

Keep reconnaissance tied to a workspace. The scanner, proxy, agent, and campaign commands reuse this context.

Broad HTTP Scan

scanner -u http://127.0.0.1 --threads 10

The broad scan runs compatible HTTP scanner modules and groups findings by severity, target, and evidence. Use a lower thread count on fragile targets or when the rules of engagement require quiet traffic.

Targeted Modules

scanner -u http://127.0.0.1 --module security_headers_detect -v
scanner -u http://127.0.0.1 --module server_banner_detect -v
scanner -u http://127.0.0.1 --module sensitive_files_detect -v

Targeted execution is useful when a broad scan flags an issue and you need cleaner evidence. Prefer module output with request path, response code, matched indicator, and severity.

Manual Module Flow

use scanner/http/security_headers_detect
set rhost 127.0.0.1
set rport 80
set ssl false
run

Use manual mode when options matter or when the module should run against a specific host, port, path, or authenticated context.

Search By Theme

search --type scanner --protocol http sqli
search --type scanner --protocol http xss
search --type scanner --protocol http upload
search csrf --type scanner

Search results should be treated as a module catalog, not a run plan. Select modules that match the application, scope, authentication state, and allowed risk level.

Workspace Review

host services 127.0.0.1
vuln list
campaign --preview
history

Before moving to exploitation or agent automation, confirm that the workspace contains the expected host, services, findings, and command history.

Finding Quality