Finding files and folders with ZAP
OWASP Zed Attack Proxy (ZAP) is a very versatile tool for web security testing. It has a proxy, passive and active vulnerability scanners, fuzzer, spider, HTTP request sender, and some other interesting features. In this recipe, we will use the recently added Forced Browse, which is the implementation of DirBuster inside ZAP.
Getting ready
For this recipe to work, we need to use ZAP as a proxy for our web browser:
- Start OWASP ZAP from Kali Linux menu and, from the application's menu, navigate to
Applications|03 -Web Application Analysis|owasp-zap. - Next, we'll change ZAP's proxy settings. By default, it uses port
8080, but that may interfere with other proxies like Burp Suite if we have them running at the same time. In ZAP, go toTools|Options|Local Proxiesand change the port to8088:
- Now, in Firefox, go to the main menu and navigate to
Preferences|Advanced|Network; inConnection, click onSettings. - Choose a
Manual proxy configurationand set127...
