Search icon CANCEL
Arrow left icon
Explore Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Conferences
Free Learning
Arrow right icon
Arrow up icon
GO TO TOP
Securing Network Infrastructure

You're reading from   Securing Network Infrastructure Discover practical network security with Nmap and Nessus 7

Arrow left icon
Product type Course
Published in Mar 2019
Publisher
ISBN-13 9781838642303
Length 538 pages
Edition 1st Edition
Tools
Arrow right icon
Authors (2):
Arrow left icon
Sairam Jetty Sairam Jetty
Author Profile Icon Sairam Jetty
Sairam Jetty
Sagar Rahalkar Sagar Rahalkar
Author Profile Icon Sagar Rahalkar
Sagar Rahalkar
Arrow right icon
View More author details
Toc

Table of Contents (28) Chapters Close

Title Page
Copyright and Credits
About Packt
Contributors
Preface
1. Introduction to Network Vulnerability Scanning FREE CHAPTER 2. Understanding Network Scanning Tools 3. Port Scanning 4. Vulnerability Scanning 5. Configuration Audits 6. Report Analysis and Confirmation 7. Understanding the Customization and Optimization of Nessus and Nmap 8. Network Scanning for IoT, SCADA/ICS 9. Vulnerability Management Governance 10. Setting Up the Assessment Environment 11. Security Assessment Prerequisites 12. Information Gathering 13. Enumeration and Vulnerability Assessment 14. Gaining Network Access 15. Assessing Web Application Security 16. Privilege Escalation 17. Maintaining Access and Clearing Tracks 18. Vulnerability Scoring 19. Threat Modeling 20. Patching and Security Hardening 21. Vulnerability Reporting and Metrics 1. Other Books You May Enjoy Index

Testing tools


We have already seen a list of various tools earlier in this chapter that we can use for performing web application security testing. In this section, we'll have a brief introduction to two such tools.

OWASP ZAP

OWASP ZAP is a multi-functional tool that can perform an array of tasks related to application security testing. It is capable of doing automated scanning as well and is extremely effective in manual testing and fuzzing. OWASP ZAP can be downloaded from https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project.

The following image shows the initial OWASP ZAP console. The left pane displays the site hierarchy, the right pane displays individual requests and responses, and the bottom pane displays active scans:

 

 

We can either first crawl the application or directly enter the URL to attack as shown in the following image. We can see the active scan in the bottom pane and, once it is completed, we can simply click the Report menu and select Generate HTML Report.

Burp Suite...

lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at R$50/month. Cancel anytime