<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-web-application-scanning
description: >-
  Scan web applications for OWASP Top 10 vulnerabilities using nuclei, OWASP ZAP,
  and Nikto. Covers authenticated scanning, API fuzzing, crawl-based discovery,
  and CI/CD integration for continuous web application security testing.
domain: cybersecurity
subdomain: vulnerability-management
tags:
  - web-scanning
  - owasp
  - nuclei
  - zap
  - nikto
  - dast
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Performing Web Application Scanning

## Overview

Web application scanning (DAST) identifies vulnerabilities in running applications
by sending crafted requests and analyzing responses. Unlike SAST, DAST tests the
deployed application — catching misconfigurations, injection flaws, authentication
bypasses, and business logic issues visible only at runtime.

## Prerequisites

| Requirement | Install |
|---|---|
| nuclei | `go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest` |
| OWASP ZAP | `docker pull ghcr.io/zaproxy/zaproxy:stable` |
| Nikto | `apt install nikto` or `brew install nikto` |
| httpx | `go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest` |
| Python 3.10+ | Agent tooling |

## Key Concepts

### nuclei Web Scanning

```bash
# Full OWASP Top 10 scan
nuclei -u https://target.example.com -tags owasp-top-10 -json -o owasp_results.json

# SQL injection and XSS focused scan
nuclei -u https://target.example.com -tags sqli,xss -severity critical,high \
  -json -o injection_results.json

# Authenticated scan with cookies
nuclei -u https://target.example.com -tags owasp-top-10 \
  -H "Cookie: session=abc123def456" -json -o auth_scan.json

# Scan with custom headers and rate limiting
nuclei -u https://target.example.com -tags cve -rate-limit 50 \
  -H "Authorization: Bearer $TOKEN" -json -o cve_results.json

# Template-based scan for specific CWEs
nuclei -u https://target.example.com \
  -t nuclei-templates/http/vulnerabilities/ \
  -severity critical,high,medium -json -o vuln_results.json

# Crawl and scan all discovered endpoints
katana -u https://target.example.com -d 3 -jc | \
  nuclei -tags owasp-top-10 -json -o crawl_scan.json
```

### OWASP ZAP Scanning

```bash
# ZAP baseline scan (passive only — safe for production)
docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py \
  -t https://target.example.com -J zap_baseline.json

# ZAP full scan (active — authorized targets only)
docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-full-scan.py \
  -t https://target.example.com -J zap_full.json

# ZAP API scan with OpenAPI spec
docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-api-scan.py \
  -t https://target.example.com/openapi.json -f openapi -J zap_api.json

# ZAP with authentication context
docker run --rm -v $(pwd):/zap/wrk:rw -t ghcr.io/zaproxy/zaproxy:stable \
  zap-full-scan.py -t https://target.example.com \
  -n /zap/wrk/context.xml -J zap_auth.json
```

### Nikto Scanning

```bash
# Basic web server scan
nikto -h https://target.example.com -Format json -output nikto_results.json

# Scan specific port with SSL
nikto -h target.example.com -port 8443 -ssl -Format json -output nikto_ssl.json

# Tuning: focus on specific test categories
# 1=Files, 2=Misconfig, 3=Info, 4=Injection, 5=Remote, 6=DOS, 7=RFI
nikto -h https://target.example.com -Tuning 1234 -Format json -output nikto_tuned.json
```

### Scan Scoping

| Scope Level | Tools | Use Case |
|---|---|---|
| Passive | ZAP baseline, httpx | Production-safe reconnaissance |
| Active light | nuclei (rate-limited) | Staging environments |
| Active full | ZAP full, Nikto | Authorized test environments |
| Authenticated | ZAP + context, nuclei + headers | Post-auth vulnerability discovery |

## Workflow

1. **Discover** — Enumerate live hosts and endpoints with httpx and katana
2. **Passive scan** — Run ZAP baseline for safe initial assessment
3. **Active scan** — Execute nuclei OWASP templates against authorized targets
4. **Deep scan** — Nikto for server misconfigurations, ZAP full for injection testing
5. **Analyze** — Deduplicate findings, correlate across tools, validate true positives
6. **Report** — Generate prioritized finding report with reproduction steps

## Detection

```yaml
title: Web Application Scanning Detection
id: 6220fc63-b533-4da0-880c-c8c2273cfd0c
status: experimental
description: Detects suspicious activity related to performing web application scanning techniques in vulnerability management context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*web*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.discovery
falsepositives:
  - Vulnerability scanner performing scheduled assessment scans
```

## Verification

| Check | Method |
|---|---|
| Templates current | `nuclei -update-templates` — confirms latest |
| Scan completed | JSON output contains `results` array |
| No false starts | HTTP 200/30x on target before scanning |
| Auth working | Authenticated endpoints return non-401 responses |
| Rate limits respected | No 429 responses in scan output |

## References

- [nuclei Documentation](https://docs.projectdiscovery.io/tools/nuclei)
- [OWASP ZAP Documentation](https://www.zaproxy.org/docs/)
- [OWASP Top 10](https://owasp.org/www-project-top-ten/)
- [Nikto Documentation](https://github.com/sullo/nikto/wiki)
