Summary

In this chapter, we discussed the use of automated vulnerability scanners in web application penetration testing, the risks posed by the use of automated tools when testing production environments, and considerations that needed to be taken into account before using them.

Next, we moved on to the use of some of the scanners included in Kali Linux, such as Nikto, Skipfish, Wapiti, and OWASP-ZAP. We also talked about specialized scanners for Content Management Systems such as WordPress, Joomla, and Drupal. We addressed the topic of fuzzing as a separate technique from scanning. We used the OWASP-ZAP fuzzer and Burp Intruder to test multiple inputs over a single input.

Finally, we discussed some of the tasks necessary to be done after automated scanning or fuzzing is complete. You need to validate the scanner's results in order to eliminate all false positives, and you need to test the application manually, as there are vulnerabilities that an automated scanner will not be able to find...