Web Application Scanning

Scanning MED v1.0.0 updated 2026-06-17

Use web application scanners to detect OWASP Top 10 vulnerabilities, misconfigurations, and common web security issues across all discovered web assets.

Tools

Machine-readable JSON available at:

https://reconatlas.pages.dev/api/checklists/web-vulnerability-scanning

// checklist steps

webscan-01

Scan for known vulnerabilities with Nikto

Run Nikto against all discovered web hosts to identify outdated server software, dangerous files, and common misconfigurations.

nikto -h https://target.com -output nikto-out.txt -Format txt
nikto -h https://target.com -Tuning 1234567890 -output nikto-full.txt
nikto -h targets.txt -output nikto-batch.txt -Format csv

Nikto is noisy and easily detected by WAFs. Run it last or against staging environments when possible. Use -Tuning to focus on specific test categories.

webscan-02

Scan with OWASP ZAP active scanner

Launch an OWASP ZAP active scan to test for injection flaws, XSS, CSRF, and other OWASP Top 10 issues automatically.

zap-cli quick-scan -s xss,sqli https://target.com
zap-cli active-scan https://target.com
zap-cli report -o zap-report.html -f html

Import your authenticated session into ZAP before running the active scan to cover authenticated endpoints. Use the Ajax Spider for JavaScript-heavy applications.

webscan-03

Scan with Burp Suite active scanner

Use Burp Suite's active scanner against crawled endpoints to identify injection points, access control issues, and business logic flaws.

# Configure Burp Suite target scope and run active scan via GUI
# Export findings: Target > Site map > right-click > Issues > Report
curl -sk -x http://127.0.0.1:8080 https://target.com

Burp Suite Pro is required for active scanning. Configure scan speed to 'Thorough' for production targets to reduce false negatives. Always review scanner findings manually.

webscan-04

Discover hidden directories and files

Brute-force directories, backup files, and sensitive paths that crawlers miss.

feroxbuster -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -x php,asp,aspx,jsp,bak,old,conf -o ferox-scan.txt
feroxbuster -u https://target.com -w /usr/share/seclists/Discovery/Web-Content/common.txt --dont-extract-links -o ferox-common.txt

Use -x to append extensions relevant to the target's technology stack. Check for .bak, .old, and .swp files that often contain source code.

webscan-05

Scan for CMS-specific vulnerabilities

Run specialised scanners against WordPress, Joomla, and other CMS platforms to find plugin vulnerabilities, weak credentials, and misconfigurations.

wpscan --url https://target.com --enumerate vp,vt,u --api-token YOUR_TOKEN -o wpscan-out.txt
wpscan --url https://target.com --passwords /usr/share/wordlists/rockyou.txt --usernames admin
joomscan -u https://target.com -o joomscan-out/

WPScan requires an API token for vulnerability data lookups. Always enumerate plugins and themes — they are responsible for the majority of WordPress vulnerabilities.

webscan-06

Scan API endpoints for security issues

Test discovered API endpoints for authentication bypass, mass assignment, BOLA/IDOR, and injection vulnerabilities.

nuclei -l api-endpoints.txt -t http/vulnerabilities/ -o api-vulns.txt
nuclei -l api-endpoints.txt -t http/misconfiguration/ -o api-misconfig.txt
zap-cli quick-scan https://target.com/api/v1/

Focus on BOLA (Broken Object Level Authorisation) — it remains the most common API vulnerability. Test by modifying object IDs in requests.

webscan-07

Analyse HTTP security headers

Check for missing or misconfigured security headers that enable client-side attacks.

curl -sk -I https://target.com | grep -iE '(strict-transport|content-security|x-frame|x-content-type|referrer-policy|permissions-policy)'
nuclei -u https://target.com -t http/misconfiguration/http-missing-security-headers.yaml -o headers-missing.txt
python3 shcheck.py https://target.com

Missing Content-Security-Policy and X-Frame-Options headers are commonly reported but often low severity. Focus on targets where these enable concrete exploitation chains.

Overview

Web application scanning automates the detection of common vulnerabilities across your target’s web assets. While automated scanners will not catch everything, they efficiently identify low-hanging fruit and provide a baseline for deeper manual testing.

Scanner selection

Choose scanners based on the target’s technology stack:

Generic web servers: Nikto + OWASP ZAP cover most common issues
WordPress/Joomla: WPScan and Joomscan find plugin and theme vulnerabilities
APIs: Nuclei templates and ZAP’s API scanning mode handle REST and GraphQL
Authenticated surfaces: Burp Suite excels when you need session handling

Reducing false positives

Automated scanners produce noise. Triage effectively by:

Cross-referencing findings across multiple tools
Verifying injection findings manually before reporting
Filtering out informational headers-only findings unless they enable a concrete attack

// references

← All checklists JSON ↗