Question

During an internal engagement, you have identified a web server running on 10.0.5.22 over ports 80 and 443. The client has authorized active enumeration of exposed web content. You want to use Nmap to discover common web directories, application paths, and interesting files on the host before launching a dedicated web scanner. Which Nmap command best supports this goal?

Accepted Answer

nmap -p 80,443 --script http-enum 10.0.5.22

Answer

nmap -p 80,443 -sV --version-intensity 9 10.0.5.22

Answer

nmap -p 80,443 --script ssl-cert 10.0.5.22

Answer

nmap -p 80,443 -O --osscan-guess 10.0.5.22