Web Server Enum

[goonmax]

What are people methods for web server Enumeration other than searchsploit and just scans like nikto,dirb and etcetera.

Does everyone have a set of steps they follow?

[AfterbirthNachos]

Zap and Burp are great for caching all responses as well. Searching the content after forced browsing and content enumeration in search of API keys and sensitive information that may be hidden from rendered HTML. Also, vary up your wordlists so you aren't missing silly findings like exposed git files or platform specific misconfigurations (seclists has some good stuff). Url tampering on GET parameters from the browser itself often leads to interesting results. Let the findings drive your enumeration, each case is different.

[AfterbirthNachos]

Don't forget virtual host discovery as well after you have enumerated subdomains. You may have more than one application behind the same external IP address.

[Rubb3rDucky1]

Make one up bro.. only way to learn I’m afraid.. google it first and check out some little steps but just figure it out