Using ZAP's spider
Downloading a full site to a directory in our computer leaves us with a static copy of the information; this means that we have the output produced by different requests, but we neither have such requests nor the response states of the server. To have a record of that information, we have spiders, such as the one integrated in OWASP ZAP.
In this recipe, we will use ZAP's spider to crawl a directory in our vulnerable_vm and will check on the information it captures.
Getting ready
For this recipe, we need to have the vulnerable_vm and OWASP ZAP running, and the browser should be configured to use ZAP as proxy. This can be done by following the instructions given in the Finding files and folders with ZAP recipe in the previous chapter.
How to do it...
To have ZAP running and the browser using it as a proxy, browse to
http://192.168.56.102/bodgeit/.In the Sites tab, open the folder corresponding to the test site (
http://192.168.56.102in this book).Right click on GET:bodgeit.
From...
