Information Gatheringapacheuserdirenumerationusernamesweb

Apache Users

Apache-users enumerates usernames on systems running Apache with the UserDir module enabled. It uses a dictionary of usernames to probe for valid users via HTTP requests.

Description

Apache-users is a Perl script designed to identify valid usernames on target systems that have Apache's UserDir module active. This module allows directory listings based on usernames, such as http://target/~username/, which can leak information about system users when probed systematically.

Use cases include reconnaissance during penetration testing to map user accounts on web servers. It is particularly effective against misconfigured Apache servers where UserDir is enabled, a common default or oversight in some deployments. The tool supports multithreading for faster enumeration against large username lists.

Contextually, it fits into information gathering phases, helping attackers or testers build a profile of the target before attempting brute-force logins or social engineering.

How It Works

The tool sends HTTP requests to paths like http://target/~username/ using a provided dictionary of usernames. It analyzes the HTTP response codes; a specified code (default 403) indicates a valid username, while others suggest non-existence. Supports SSL/TLS, custom ports, and parallel threading via Perl's Parallel::ForkManager. Leverages LWP for HTTP handling and Socket::IP for connectivity.

Installation

bash

sudo apt install apache-users

Flags

-hTarget host IP or hostname (e.g., -h 192.168.1.202)

-lPath to dictionary file of usernames (e.g., -l /usr/share/wordlists/metasploit/unix_users.txt)

-pPort to use (default 80, e.g., -p 80)

-sSSL support (1=true, 0=false, e.g., -s 0)

-eHTTP error code indicating valid user (default 403, e.g., -e 403)

-tNumber of threads (e.g., -t 10)

Examples

Enumerates usernames on host 192.168.1.202 using the specified wordlist, port 80, no SSL, 403 as valid code indicator, with 10 threads

apache-users -h 192.168.1.202 -l /usr/share/wordlists/metasploit/unix_users.txt -p 80 -s 0 -e 403 -t 10

Basic usage with defaults: port 80, SSL off, 403 code, single thread

apache-users -h 192.168.1.202 -l /usr/share/wordlists/metasploit/unix_users.txt

Targets HTTPS server on port 443 with SSL enabled, 5 threads

apache-users -h example.com -l users.txt -p 443 -s 1 -t 5

Uses 404 as valid user indicator with high threading

apache-users -h 10.0.0.5 -l /usr/share/wordlists/rockyou.txt -e 404 -t 20

Probes non-standard port 8080 without SSL

apache-users -h target.local -l custom_users.txt -p 8080 -s 0

Single-threaded enumeration for stealth or debugging

apache-users -h 192.168.1.1 -l /usr/share/wordlists/metasploit/unix_users.txt -t 1

Updated 2026-04-16kali.org ↗