Mastering Kali Linux for Web Penetration Testing

Going active with ZAP

If we want to run an active scan, we can simply enter the DVWA's address in the URL to attack the application and click Attack. Many use this feature, but understanding the scans can help you better use the tool and pick the correct combination of functions to use.

A quick scan reveals tons of vectors, but one of the most pressing is those pesky passwords.

The Sites panel maps the site, showing files and the directory structure, as seen in the previous screenshot. In the lower window, we'll notice that Alerts are grouped according to their type, and ZAP makes pivoting into follow-up actions pretty easy. We can see differently ...