I'm scanning websites with OWASP ZAP and noticed that the Spider attack and Force Browse attack return somewhat different results.

What are the differences between Web Spiders (Web Crawlers) and Force Browsing (of directories and files)?

  • The OWASP ZAP documentation explains the difference. – schroeder Oct 8 '19 at 6:56

Web scrawling is the method which used by attackers to get links in web applications. Usually web scrawling is not giving too much false positives. In the other hand, with force browsing you can find bunch of "hidden" directories which you can't find from scrawling(like /admin/, /test/ and etc.). The methodology is doing web scrawling and then force browsing.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.