Configuring, Crawling, Scanning, and Reporting
We’ve now reached Chapter 3. Here, we’ll start taking a deep dive into hacking, but before we get to that, we first need to understand how to set up our browser and Zed Attack Proxy (ZAP) to capture traffic successfully and without error, and learn the varying options you have as a user. We’ll cover the basics of crawling (or spidering) and using the application to map the Sites tree and prepare for scanning (audit). Finally, we’ll go over reporting and how to generate a report that fits your assessment, and we will interpret that data for better results.
In this chapter, we will cover the following recipes:
- Setting scope in ZAP
- Crawling with the Spider
- Crawling with the AJAX Spider
- Scanning a web app passively
- Scanning a web app actively
- Generating a report
