Using WebScarab

WebScarab is another web proxy full of features that may be interesting to penetration testers. In this recipe, we will use it to spider a website.

Getting ready

In its default configuration, WebScarab uses port 8008 to capture HTTP requests, so we need to configure our browser to use that port in the localhost as a proxy. We follow steps similar to those of the OWASP ZAP and Burp Suite configurations in the browser; in this case the port must be 8008.

How to do it...

WebScarab can be found in Kali's Applications menu; go to 03 - Web Application Analysis | webscarab. Alternatively, from the terminal, run the webscarab command. Proceed with the following steps:

1. Browse to the BodgeIt application of vulnerable_vm (http://192.168.56.11/bodgeit/). We will see that it appears in the Summary tab of WebScarab.
2. Now we right-click on the bodgeit folder and select Spider tree from the menu:

3. All requests will appear in the bottom half of the Summary and the tree will be filled as the spider...