Crawling target sites
Crawling is a type of scan that’s used to map out a web application. This mapping exercise is necessary to uncover links, folders, and files present within the target application. While running, Burp Suite will add found assets to Target | Site map.
Crawling should occur before scanning since testers wish to identify all possible paths and functionality before looking for vulnerabilities. There are built-in Burp Suite scripts specific to crawling available in Configuration library, as shown in the following screenshot:
Figure 3.114 – Crawling scripts available in Configuration library
Getting ready
Using the OWASP Mutillidae II application found within the OWASP BWA VM, we will configure and use one of the built-in scripts to crawl through the application.
How to do it...
- Ensure Burp Suite and the OWASP BWA VM are running and that you are either using Burp’s browser or have FoxyProxy turned on...
