> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/introduction-to-the-web-and-http-protocol/scanning-web-application.md). # Scanning Web Application ### Scanning Web Application with ZAProxy ZAP Proxy, OWASP, its a great tool for scanning web apps and websites and it will run some vulnerability scans for us. ``` nmap -sV /24 ``` * At portal.php we have HTML Injection Reflected * Open Zap, Manual Explore, put the URL and enable the HUD and application Firefox * the site visits simultaneously gets added to the ZAP. right click on the requests > Include in Context > Default context and choose authentication and Login Form Target URI add Regex pattern identified in Logged Out with "Login". include Users with checkbox Right click on root folder > attack > spider Right click on root folder > attack > active scan *** ### Scanning Web Application with Nikto ``` nikto -H ``` ``` nikto -h http:// ``` * It a vulnerability scanning and can be used for enumeration of the target. * Test for file inclusion ``` nikto -h http:/// -Tuning 5 -Display V ``` * Output to file ``` nikto -h http:/// -Tuning 5 -Display V -o nikto.html -format htm ``` {% embed url="" %} *** ### Passive Crawling with Burp Suite ``` ip a ``` * browse to the target ip address * open Burp Suite and turn on FoxyProxy * Burp Suite > Proxy > HTTP History In target tab > sitemap, we have a better tree of the directories. Add the target to scope so we don't touch out of the scope