Web App Penetration Testing - #2 - Spidering & DVWA

Web App Penetration Testing - #2 - Spidering & DVWA

by HackerSploit · View the channel on PSI

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 HackerSploit 👥 1.0M 📅 March 1, 2018 ⏱ 11 min 👁 183K 📄 tutorial 🧭 2026-10-10
Available in: English (current) Français

Keywords

spideringBurp SuiteDVWAMetasploitableweb application security

Summary

In this tutorial, HackerSploit introduces the concept of spidering within web application penetration testing, using Burp Suite against the Damn Vulnerable Web Application (DVWA) hosted on Metasploitable 2. The video begins by setting up the environment, then explains the theoretical foundation of spidering: mapping out a web application to identify URLs, forms, and content. The author walks through Burp Suite’s Spider tab, detailing the Control and Options sections. He explains key settings such as maximum link depth (recommending 3-5 to avoid overloading the target), passive spidering (which monitors proxy traffic without new requests), form submission, and the spider engine (thread count recommended 2-5). He also touches on request header manipulation and the importance of understanding HTTP headers. The video is theory-heavy, promising a practical demo in the next episode. The content is clear and structured, aimed at beginners but providing useful insights for intermediate practitioners.

145 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video delivers valuable foundational knowledge on spidering, emphasizing the ‘why’ behind each configuration option. The author’s explanations are concise and practical, linking settings to real-world performance considerations (e.g., avoiding server overload). The argumentation is sound, based on hands-on experience and standard security testing principles. The lack of visual demonstration in this episode slightly reduces the immediate utility, but the strategic decision to separate theory from practice is justified.

Scientific Rigor, Source Quality, Title Accuracy

The video does not cite external academic sources, but it references well-known tools (Burp Suite, DVWA, Metasploitable) accurately. The description provides links to the author’s website, app, and a course, but these are not direct research sources. The title matches the content precisely, focusing on spidering techniques. No contradictory claims or inaccuracies were identified; the information aligns with common cybersecurity practice.

145 words

Title / Content Match

The title accurately reflects the content: a focused tutorial on using Burp Suite's spidering functionality against DVWA.

Quality & Reliability

7/10

Video is a practical tutorial with clear explanations of spidering concepts, but lacks formal citations or references. The content is based on the author's experience and standard tools, generally reliable but not rigorously sourced.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • HackerSploit Website — Author's official website for additional resources and contact.
  • HackerSploit Android App — Official mobile app providing news and updates.
  • The Complete Deep Web Course 2018 — Paid course offered by the author, for deeper learning.

Concurring Sources

  • Burp Suite documentation — Official documentation confirms spidering features and settings.
  • DVWA project — Open-source project providing the vulnerable application used.

External References

Contribution & Novelties

The video’s novelty lies in its clear, structured explanation of Burp Suite’s spidering features, tailored for beginners entering web app security. It emphasizes configuration trade-offs, such as link depth and thread counts, which are often overlooked in quick tutorials. <br><br>Pour aller plus loin :<br>- Burp Suite (Wikipedia) — Background on the tool and its capabilities.<br>- Damn Vulnerable Web Application (DVWA) — The intentionally vulnerable app used in the video.<br>- Metasploitable (Rapid7) — The vulnerable VM environment referenced for practice.

79 words

Radar Profile

The radar profile shows balanced scores across information quantity, quality, technical level, and reliability, with a slight dip in quantity due to the theory-only focus. The video is solid for foundational learning but less information-dense than a full demo.

Reliability 7/10

💬 Très positif. Sur les 30 commentaires analysés, la majorité exprime de la gratitude et de l'appréciation pour la clarté des explications, avec quelques demandes de mises à jour pour les versions récentes de Burp Suite.