6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping

The remaining objective 2.2 bullets are web application firewall (WAF) enumeration (with origin address called out), web crawling, manual enumeration (robots.txt, sitemap, platform plugins), and attack path mapping. Together they answer two exam questions: how do you see the real application when a WAF sits in front, and how do you connect every earlier inventory fact into a path before you exploit anything?

WAF enumeration and origin address

A WAF is a reverse-proxy control that inspects HTTP and stops or distorts attacks before they reach the origin server. WAF enumeration first asks whether a WAF is present. Clues include vendor cookies and headers (cloud provider WAF cookies, cf-ray-style identifiers, X-Sucuri or similar security headers), unusual status codes (403, 406, 501) for harmless probes, identical block pages across applications, and timing that does not match the origin. Identifying which WAF is present matters because bypass research is product-specific — still identification, not a payload pack.

The PT0-003 sub-bullet that candidates under-study is origin address. If the WAF is the only published A record, the application origin may still have a leftover IP: an old A record in historical DNS, a hostname such as origin.example.com or direct.example.com that still resolves, a mail server whose email headers reveal an internal or cloud IP, a certificate subject-alternative name that points at a non-proxied host, or a non-proxied service on the same customer network — FTP, VPN, mail, staging, or an API on another hostname that never sat behind the WAF. Those leads are how testers find an origin. Hitting that origin to bypass the WAF is allowed only if it is in scope. A historical A record that now belongs to a previous tenant, a content delivery network anycast address, or a neighbor in a shared cloud range is not yours because a WAF annoyed you.

Exam trap: firing injection payloads at the WAF to "see which signatures trip" and calling that WAF enumeration. That is attack traffic. Another trap: declaring that any WAF makes origin hunting automatically out of scope. The RoE decides. If origin discovery is in scope and the origin is customer-owned, record the IP and whether the WAF can be bypassed by talking to it directly. If the origin is excluded, stop at detection.

Web crawling versus manual enumeration

Web crawling is an automated spider that follows in-scope links, forms, and redirects to build a map of URLs. It is how you learn the real surface of a large application instead of guessing from the homepage. Crawlers must stay on the named domain, URL prefix, or host in the statement of work. Following every third-party script host, payment iframe, or CDN origin is not thoroughness; it is leaving scope.

Manual enumeration is the complementary pass CompTIA lists explicitly. Fetch robots.txt: Disallow lines are a map of paths the owner did not want indexed — /admin, /backup, /internal-api — not a legal fence for an authorized tester. Fetch sitemap.xml (and sitemap index files) for URLs marketing wanted search engines to see, including forgotten locale copies and old campaigns. Platform plugins are the WordPress /wp-content/plugins/ and /wp-content/themes/ trees, Joomla component paths, Drupal modules, and similar fingerprints. A plugin with a known version is inventory for later vulnerability analysis; here you are naming what is installed. Read JavaScript bundles for client-side routers: /settings/api-tokens, /admin/impersonate, undocumented REST paths. Directory brute-force tooling is the later tools objective; this section's job is knowing what you are looking for by hand even when a spider already ran.

Exam trap: crawler versus reading robots.txt

If the stem shows a tester fetching robots.txt and sitemap.xml and checking WordPress plugin paths, the answer is manual enumeration. If the stem shows a spider following in-scope links to build a URL list, the answer is web crawling. You usually need both. A crawler will not see a path that no page links to; robots.txt and a plugin directory will.

Attack path mapping: graph the inventory, do not fire it yet

Attack path mapping is how users, groups, computers, shares, and protocol weaknesses connect. In Active Directory, that thinking is BloodHound-style: who is a member of which group, who has a session on which computer, who can control a Group Policy Object, which service account is over-permissioned. At the enumeration stage you are drawing the graph. You are not yet performing Kerberos attacks, not yet relaying SMB, and not yet dropping a payload. Domain 4 and Domain 5 are where a mapped path becomes an exploit chain, and only inside the RoE.

Worked example: from Nmap ports to a mapped path

Collect the chapter's facts as edges, not as trivia. Host discovery found 10.4.12.8 alive. Service discovery found 445/tcp and 3389/tcp. OS fingerprinting said Windows Server 2019. Protocol enumeration said SMB signing is not required. Share enumeration found a guest share IT-ARCHIVE. Local user enumeration found backup_svc with a description that it runs overnight restores from that share. Secrets enumeration of the share may add a cloud key or a password file. Permission enumeration may show that backup_svc has restore or backup-related rights a normal user lacks.

Attack-path mapping says: a stranger who can read IT-ARCHIVE may recover configuration or credential material; that material may authenticate as backup_svc; backup_svc is tied to restore operations on a Windows server that also offers RDP; unsigned SMB is a later network-attack edge against this host or its peers. That sentence is the map. It is not a completed demonstration, not ransomware, and not a reason to skip the report's evidence trail. If BloodHound (or equivalent directory data) later shows backup_svc nested into a privileged group, you add that edge. You still do not "just run the exploit" because the graph looks pretty.

Web and WAF facts join the same graph. If the company's public app sits behind a WAF but a staging hostname from sitemap.xml or a leftover A record reaches the origin, that is another edge — if that origin is in scope. If robots.txt discloses /internal-api and JavaScript lists a /restore route, those URLs may be how backup_svc is meant to work. Mapping is the habit of drawing those connections while you enumerate, so exploitation hours later are spent on the shortest realistic path instead of random high CVSS rows.