Chapter 3

1. wfuzz, paired with a comprehensive wordlist represents a powerful brute force mapping tool—one that's effective, but should be used only when brute forcing is appropriate.
2. Site maps are a simple, free shortcut to basic reconnaissance. If one doesn't exist, you can use Burp Spider to map the target application.
3. If you're looking for a lower-impact alternative for mapping an attack surface, you can navigate the target application with the browser connected to your Burp Proxy and Burp will automatically build a sitemap.
4. Scrapy is a great, extensible solution for scraping sites.
5. Writing short, single purpose scripts allows you to mix and match functionality, with a common foundation of text ensuring interoperability.
6. SecLists is an excellent curated resource of a variety of malicious inputs.
7. Striker is a Python scanner that is particularly useful in...