CompTIA Security+ Certification SY0-601: The Total Course - OWASP ZAP Web App Scan Lab

The video tutorial demonstrates how to scan a web application for vulnerabilities using tools like OWASP ZAP, which is available in Kali Linux. It covers setting up a Kali Linux virtual machine, initializing and updating the OWASP ZAP tool, and starting a Metasploitable virtual machine. The tutorial guides users through conducting a vulnerability scan, analyzing results, and understanding potential security issues such as cookies without HTTP-only flags, which can lead to cross-site scripting attacks.

Which tool is included in Kali Linux for scanning web applications?

• OWASP ZAP

• Nmap

• Wireshark

• Burp Suite

What is the purpose of the Metasploitable virtual machine?

• To provide an intentionally vulnerable environment for testing

• To function as a database server

• To serve as a secure web server

• To act as a firewall

What command is used to find the IP address of the Metasploitable VM?

• ipconfig

• ping

• ifconfig

• traceroute

What type of spider is used in the OWASP ZAP tool for scanning?

• Googlebot

• Bingbot

• Ajax Spider

• Yahoo Slurp

What vulnerability is indicated by the absence of an HTTP-only flag on cookies?

• Cross-Site Scripting

• Buffer Overflow

• Denial of Service

• SQL Injection