Finding files and folders with ZAP

OWASP Zed Attack Proxy (ZAP) is a very versatile tool for web security testing. It has a proxy, passive and active vulnerability scanners, fuzzer, spider, HTTP request sender, and some other interesting features. In this recipe, we will use the recently added Forced Browse, which is the implementation of DirBuster inside ZAP.

Getting ready

For this recipe to work, we need to use ZAP as a proxy for our web browser:

1. Start OWASP ZAP from Kali Linux menu and, from the application's menu, navigate to Applications | 03 - Web Application Analysis | owasp-zap.
2. Next, we'll change ZAP's proxy settings. By default, it uses port 8080, but that may interfere with other proxies like Burp...