Web App Vulnerability Scanning

Prerequisites: Completion of Reconnaissance and Footprinting; Docker installed and running; Java installed if running OWASP ZAP outside of Docker.

Targeted versions: Verified against the OWASP Top 10:2025 (released November 2025 — the current edition, superseding 2021; this project references its category names and numbering directly, including the merge of SSRF into Broken Access Control and the renamed/added categories), the OWASP Juice Shop project (officially supports Node.js 22.x/24.x/26.x and ships an actively maintained bkimminich/juice-shop Docker image), Gobuster v3.6 (current at time of writing — confirm with gobuster version), and OWASP ZAP, which ships both a numbered stable release and rolling weekly builds; check zaproxy.org/download for the current stable version number before starting, since this project's ZAP steps target the current stable line as of July 2026 rather than a specific pinned version.

A vulnerability scanner's output is a list of hypotheses, not a list of confirmed findings — every automated scanner produces false positives, and treating a raw scanner alert as a client-ready finding is one of the most common mistakes a beginner pentester makes. This project builds the full scanning workflow — directory discovery, signature-based scanning with Nikto, and OWASP ZAP's automated crawl-and-attack — against OWASP Juice Shop, a deliberately vulnerable web app built specifically for this kind of practice. The goal isn't just running the tools; it's learning to read what they return against the current OWASP Top 10:2025 categories so you can tell a real finding from noise before the next project has you actually exploit anything.