Using OWASP ZAP to scan for vulnerabilities

OWASP ZAP is a tool that we have already used ing this book for various tasks, and among its many features, it includes an automated vulnerability scanner. Its use and report generation will be covered in this recipe.

Getting ready

Before we perform a successful vulnerability scan in OWASP ZAP, we need to crawl the site:

1. Open OWASP ZAP and configure the web browser to use it as a proxy
2. Navigate to http://192.168.56.11/peruggia/
3. Follow the instructions from Using ZAP's spider in Chapter 3, Using Proxies, Crawlers, and Spiders

How to do it...

Once you have browsed through the application or run ZAP's spider against it, let's start the scan:

1. Go to OWASP ZAP's Sites panel and right-click on the peruggia folder.
2. From the menu, navigate to Attack | Active Scan, as shown in the following screenshot:

3. A new window will pop up. At this point, we know what technologies our application and server use; so, go to the Technology tab and check only MySQL, PHP, Linux, and...