Web Enumeration & Reconnaissance
Before an attacker tries to break in, they map what you have. Web enumeration shows you the same picture: which sites and services exist, what they run on, and what they reveal.
How this assessment works
Reconnaissance is the foundation of every good security assessment. It frequently uncovers assets the organisation did not know were still online, and information that is more public than intended.
Enumeration is performed only against assets you authorise, plus public sources such as certificate transparency logs and DNS records.
Testing Methodology
Automated discovery combined with manual analysis to separate genuinely interesting findings from noise.
Deliverables
- Reconnaissance report mapping your in-scope web presence
- List of exposed interfaces and overlooked assets
- Recommendations on what to restrict, remove or test further
- An asset baseline for ongoing monitoring or penetration testing
Every deliverable is written in plain English, with proof-of-concept evidence and prioritized remediation steps.
Coverage
What we examine during testing
Our structured approach ensures comprehensive coverage across the agreed scope.
Subdomain enumeration
DNS records, certificate transparency and other public sources.
Technology fingerprinting
Web servers, frameworks, CMS platforms and third-party components.
Administrative interfaces
Login panels, dashboards and management consoles exposed to the internet.
Content discovery
Backup files, old directories and resources not linked from your site.
Information exposure
Metadata, error messages and public information useful to an attacker.
Footprint mapping
A consolidated map of your organisation’s web presence.
Who this service is best for
- Organisations unsure what they have online
- A first step before a penetration test
- After mergers, rebrands or a change of web provider
Scope boundaries & limitations
Enumeration identifies what is visible and where to look next. It does not, on its own, confirm whether discovered systems are exploitable.
Need internal network or custom web application testing? Contact us to discuss tailored scoping.
The PHP2Shell Threat: How Web Enumeration Stops Mass Remote Code Execution
A global surge in automated PHP2Shell exploitation campaigns is targeting exposed web servers, turning overlooked PHP scripts and upload handlers into persistent remote shells. Here is how Dex Security’s web enumeration service detects the exposure and neutralises the threat before compromise.