Web application scanning using WMAP

WMAP is a powerful web application vulnerability scanner available in Kali Linux. It is integrated into the Metasploit Framework in the form of a plugin.

Let's look at how we can start using it:

1. We need to load and initiate the plugin within the Metasploit Framework, as in the following screenshot:

   Figure 7.8 – Loading the wmap plugin in msfconsole

2. Once the WMAP plugin is loaded into the Metasploit Framework, we need to create a new site or workspace for our scan.
3. Use wmap_sites –a <Site IP / Hostname> to add a new site and wmap_targets –t <Target URL> to specify the target website to be scanned, as in the following screenshot:

   Figure 7.9 – Loading the 'wmap' plugin in msfconsole

4. Now that we have created a new site and defined our target, we need to check which WMAP modules would be applicable against our target. For example, if our target is not SSL-enabled, then there...