2

There is no reason to overthink your penetration testing setup. As long as you are working with established tools from renowned companies - you mentioned burp as a good example - you can trust them as much as any other third party software you install on your system. There is also no reason to protect your anonymity, as you are doing nothing illegal. Having ...


1

Take a look at the OWASP ASVS, the application security verification standard. It is focused on web applications and provides a guideline for the security tests you should perform during a penetration test. Especially chapter V1.2 and chapter V2 cover a broad range of tests that should be done in regard to authentication. Keep in mind that some of them ...


1

Yup we have an FAQ for that: https://www.zaproxy.org/faq/what-options-exist-for-selective-proxying/ Options include: Via a Browser Add-on/Extension Via Global Excludes Via a PAC (Proxy Auto-Config) File Set “No Proxy For” in Your Browser


1

Just researched the same issue; the syntax for adding sites/targets with vhosts (SNI) is: Add site: wmap_sites -a example.com,http://192.168.1.1 Add target: wmap_targets -t example.com,http://192.168.1.1


1

This situation continues even after some time asked. I`ve been going through this for some time now and have to turn on debugging on the scans(pressing d repeatedly for the desired level and D to decrease to the desired level) to level three to see what is happening behind the scenes. You can get port 21, 22, 80, 8080 when none of these are up on the hosts. ...


Only top voted, non community-wiki answers of a minimum length are eligible