Technical requirements

Ideally, you should have already created your pentesting environment, as pointed out in Chapter 2. However, if you haven’t, this is not a big deal.

You can use the tools that follow to go through this chapter:

• A hypervisor such as Oracle VirtualBox is needed.
• A Linux Virtual Machine (VM); I recommend selecting either Ubuntu or Fedora distros because of the vast number of utilities on both.
• Postman (https://www.postman.com/downloads/).
• OWASP Completely Ridiculous API (crAPI) (https://github.com/OWASP/crAPI/).
• OWASP WebGoat (https://owasp.org/www-project-webgoat/).
• OWASP ZAP (https://www.zaproxy.org/).
• In terms of container engines, use either Docker or Podman, which is a superset of Docker.
• If you are going for the standalone version of WebGoat, you will need a Java runtime environment. I suggest selecting OpenJDK. Both Ubuntu and Fedora have packages for it. Other distros might have it as well.
• You will need at...