I'm scanning websites with OWASP ZAP and noticed that the Spider attack and Force Browse attack return somewhat different results.
What are the differences between Web Spiders (Web Crawlers) and Force Browsing (of directories and files)?
Web scrawling is the method which used by attackers to get links in web applications. Usually web scrawling is not giving too much false positives. In the other hand, with force browsing you can find bunch of "hidden" directories which you can't find from scrawling(like /admin/, /test/ and etc.). The methodology is doing web scrawling and then force browsing.