Kali Linux Web Penetration Testing Cookbook

Using ZAP's spider

Downloading a full site to a directory in our computer leaves us with a static copy of the information; this means that we have the output produced by different requests, but we neither have such requests nor the response states of the server. To have a record of that information, we have spiders, such as the one integrated in OWASP ZAP.

In this recipe, we will use ZAP's spider to crawl a directory in our vulnerable_vm and will check on the information it captures.

Getting ready

For this recipe, we need to have the vulnerable_vm and OWASP ZAP running, and the browser should be configured to use ZAP as proxy. This can be done by following the instructions given in the Finding files and folders with ZAP recipe in the previous chapter. ...