Using web application scanners
As an aspiring penetration tester, you will also be required to perform web application security testing based on the scope of your penetration testing engagements. In this section, you will learn how to use various types of web application scanners to identify and fingerprint web applications on a target server.Let’s get started!
WhatWeb
WhatWeb enables ethical hackers and penetration testers to identify and fingerprint the type of technologies that are running on web application servers. WhatWeb is pre-installed on Kali Linux and should be part of your arsenal of tools during your reconnaissance and vulnerability assessment phase.To profile a targeted web server using WhatWeb, please use the following instructions:
- Firstly, power-on the Kali Linux and Metasploitable 3 (Windows version) virtual machines.
- On Kali Linux, open the Terminal and use the following commands to identify whether there’s a web application running on the target:
...
