{
  "slug": "web-vulnerability-scanning",
  "title": "Web Application Scanning",
  "phase": "Scanning",
  "description": "Use web application scanners to detect OWASP Top 10 vulnerabilities, misconfigurations, and common web security issues across all discovered web assets.",
  "difficulty": "medium",
  "tags": [
    "scanning",
    "web-application",
    "owasp",
    "automated-scanning",
    "nikto"
  ],
  "tools": [
    "nikto",
    "OWASP ZAP",
    "Burp Suite",
    "feroxbuster",
    "WPScan",
    "Joomscan"
  ],
  "steps": [
    {
      "id": "webscan-01",
      "title": "Scan for known vulnerabilities with Nikto",
      "description": "Run Nikto against all discovered web hosts to identify outdated server software, dangerous files, and common misconfigurations.",
      "commands": [
        "nikto -h https://target.com -output nikto-out.txt -Format txt",
        "nikto -h https://target.com -Tuning 1234567890 -output nikto-full.txt",
        "nikto -h targets.txt -output nikto-batch.txt -Format csv"
      ],
      "notes": "Nikto is noisy and easily detected by WAFs. Run it last or against staging environments when possible. Use -Tuning to focus on specific test categories."
    },
    {
      "id": "webscan-02",
      "title": "Scan with OWASP ZAP active scanner",
      "description": "Launch an OWASP ZAP active scan to test for injection flaws, XSS, CSRF, and other OWASP Top 10 issues automatically.",
      "commands": [
        "zap-cli quick-scan -s xss,sqli https://target.com",
        "zap-cli active-scan https://target.com",
        "zap-cli report -o zap-report.html -f html"
      ],
      "notes": "Import your authenticated session into ZAP before running the active scan to cover authenticated endpoints. Use the Ajax Spider for JavaScript-heavy applications."
    },
    {
      "id": "webscan-03",
      "title": "Scan with Burp Suite active scanner",
      "description": "Use Burp Suite's active scanner against crawled endpoints to identify injection points, access control issues, and business logic flaws.",
      "commands": [
        "# Configure Burp Suite target scope and run active scan via GUI",
        "# Export findings: Target > Site map > right-click > Issues > Report",
        "curl -sk -x http://127.0.0.1:8080 https://target.com"
      ],
      "notes": "Burp Suite Pro is required for active scanning. Configure scan speed to 'Thorough' for production targets to reduce false negatives. Always review scanner findings manually."
    },
    {
      "id": "webscan-04",
      "title": "Discover hidden directories and files",
      "description": "Brute-force directories, backup files, and sensitive paths that crawlers miss.",
      "commands": [
        "feroxbuster -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,asp,aspx,jsp,bak,old,conf -o ferox-scan.txt",
        "feroxbuster -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/common.txt --dont-extract-links -o ferox-common.txt"
      ],
      "notes": "Use -x to append extensions relevant to the target's technology stack. Check for .bak, .old, and .swp files that often contain source code."
    },
    {
      "id": "webscan-05",
      "title": "Scan for CMS-specific vulnerabilities",
      "description": "Run specialised scanners against WordPress, Joomla, and other CMS platforms to find plugin vulnerabilities, weak credentials, and misconfigurations.",
      "commands": [
        "wpscan --url https://target.com --enumerate vp,vt,u --api-token YOUR_TOKEN -o wpscan-out.txt",
        "wpscan --url https://target.com --passwords /usr/share/wordlists/rockyou.txt --usernames admin",
        "joomscan -u https://target.com -o joomscan-out/"
      ],
      "notes": "WPScan requires an API token for vulnerability data lookups. Always enumerate plugins and themes — they are responsible for the majority of WordPress vulnerabilities."
    },
    {
      "id": "webscan-06",
      "title": "Scan API endpoints for security issues",
      "description": "Test discovered API endpoints for authentication bypass, mass assignment, BOLA/IDOR, and injection vulnerabilities.",
      "commands": [
        "nuclei -l api-endpoints.txt -t http/vulnerabilities/ -o api-vulns.txt",
        "nuclei -l api-endpoints.txt -t http/misconfiguration/ -o api-misconfig.txt",
        "zap-cli quick-scan https://target.com/api/v1/"
      ],
      "notes": "Focus on BOLA (Broken Object Level Authorisation) — it remains the most common API vulnerability. Test by modifying object IDs in requests."
    },
    {
      "id": "webscan-07",
      "title": "Analyse HTTP security headers",
      "description": "Check for missing or misconfigured security headers that enable client-side attacks.",
      "commands": [
        "curl -sk -I https://target.com | grep -iE '(strict-transport|content-security|x-frame|x-content-type|referrer-policy|permissions-policy)'",
        "nuclei -u https://target.com -t http/misconfiguration/http-missing-security-headers.yaml -o headers-missing.txt",
        "python3 shcheck.py https://target.com"
      ],
      "notes": "Missing Content-Security-Policy and X-Frame-Options headers are commonly reported but often low severity. Focus on targets where these enable concrete exploitation chains."
    }
  ],
  "references": [
    "https://github.com/sullo/nikto",
    "https://www.zaproxy.org/",
    "https://github.com/wpscanteam/wpscan",
    "https://owasp.org/www-project-top-ten/",
    "https://portswigger.net/burp/documentation/scanner"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}