Web App Scanning with Nikto and OWASP ZAP
Scan web applications for common vulnerabilities using Nikto and OWASP ZAP's active scanner.
Web App Scanning with Nikto and OWASP ZAP is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Web Application Attack Surface
Web apps expose complex attack surfaces: URL parameters, form fields, cookies, headers, file uploads, and APIs. Automated scanners systematically probe all of these for common vulnerabilities.
Nikto Basics
Nikto is a command-line web server scanner that checks for dangerous files, outdated software, insecure headers, and known CVEs. It is fast, simple, and noisy — not stealthy.
nikto -h http://target.com
# Key options:
# -h target host
# -p port (default 80)
# -ssl for HTTPS
# -Tuning to filter check types
# -o output file, -Format formatNikto Output Interpretation
Nikto prefixes findings with +. Look for: exposed admin interfaces, directory listings, missing security headers, outdated server versions, and potentially dangerous files like /phpinfo.php.
+ Server: Apache/2.4.49
+ /admin/: Admin login page found
+ /phpinfo.php: PHP info exposed
+ X-Frame-Options header missing
+ Allowed HTTP Methods: GET, POST, PUT, DELETEOWASP ZAP Overview
OWASP ZAP (Zed Attack Proxy) is a full-featured web app security scanner with a GUI and API. It works as a proxy, spider, and active scanner — suitable for both manual and automated testing.
ZAP Proxy Setup
Configure your browser to use ZAP as a proxy (localhost:8080). ZAP captures all traffic, building a site map. This passive phase collects information without sending attack payloads.
# Start ZAP
zap.sh
# Or headless CLI
zap.sh -daemon -port 8080
# Set browser proxy:
# HTTP: 127.0.0.1:8080ZAP Spider
The spider crawls the application by following links and form actions. The AJAX spider handles JavaScript-heavy single-page apps. Both build a complete site map for active scanning.
# CLI spider
zap-cli spider http://target.com
# AJAX spider for SPAs
# Use GUI: Tools > AJAX SpiderZAP Active Scanner
The active scanner sends attack payloads (SQL injection, XSS, path traversal) to every discovered input. Risk levels: High, Medium, Low, Informational.
zap-cli active-scan --scanners all http://target.com
# Or via API
curl "http://localhost:8080/JSON/ascan/action/scan/?url=http://target.com"Reading ZAP Alerts
ZAP groups findings into alerts. Each alert shows: risk level, confidence, affected URL, attack payload used, evidence from response, and recommended remediation. High confidence = fewer false positives.
ZAP in CI/CD Pipelines
ZAP provides a Docker image for automated scanning in pipelines. The zap-baseline.py script runs passive scanning suitable for CI; zap-full-scan.py runs active scanning.
# Docker baseline scan (passive only)
docker run -t zaproxy/zap-stable \
zap-baseline.py -t http://target.com
# Full active scan
docker run -t zaproxy/zap-stable \
zap-full-scan.py -t http://target.comComparing Nikto and ZAP
Nikto: simple, fast, command-line, best for quick checks and server-level issues. ZAP: comprehensive, proxy-based, handles complex apps, better for application-level vulnerabilities and CI integration.
Scope and Authorization
Only scan systems you own or have written authorization to test. Unauthorized scanning may violate laws (CFAA, Computer Misuse Act) and terms of service, even if no harm is intended.
Quick Check
What distinguishes ZAP's active scanner from passive scanning?
Summary: Web Scanning Tools
Nikto gives you fast server-level findings in seconds. ZAP provides deep application-level scanning with proxy interception, spidering, and active attacks. Both require authorization. In mature pipelines, automate baseline ZAP scans on every deployment to catch regressions before they reach production.
Frequently asked questions
Is the “Web App Scanning with Nikto and OWASP ZAP” lesson free?
Yes — the full text of “Web App Scanning with Nikto and OWASP ZAP” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Web App Scanning with Nikto and OWASP ZAP”?
Scan web applications for common vulnerabilities using Nikto and OWASP ZAP's active scanner. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Web App Scanning with Nikto and OWASP ZAP” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- CVE, CWE, and CVSS Scoring
- Running Nessus or OpenVAS Scans
- Web App Scanning with Nikto and OWASP ZAP
- Prioritizing and Remediating Findings