Mastering Kali Linux for Web Penetration Testing

Scanning for life (or vulnerabilities)

Proxy and Spider help build the site map, but what about testing pages, forms, and the like for whether they are vulnerable? The most broad-brush tool we can employ is Burp Scanner. Make no mistake--scanner can take a very active role and initiates what amounts to an attack on the targets in its active modes. For these reasons, please ensure you have narrowed your scopes and are cognizant of exactly what hosts you are unleashing Burp Scanner to do, especially when engaging the active scanning capability. I am convinced that it is for these far-reaching implications that Scanner was reserved for the professional license.

If you are not using Burp Suite Professional Edition, I still recommend understanding ...