Get Started
← Cyber defence · Mission 6 of 10

Find the holes in your own website before attackers do

Bots probe every website on the internet for exposed .env files, open .git folders, missing security headers and old TLS, all day, every day. Run the same checks on your own site first: an OWASP ZAP baseline scan, 11,000 Nuclei templates, a TLS and header check, and a hunt for the hidden files scanners miss. Practise on a sloppy local site from the kit, fix it, and watch 13 ZAP alerts drop to 2. Then do it for real on a site you own.

100 minIntermediateTools: FreeStep 1 free
A practice website with real problems (exposed .env and .git, leaky headers, weak cookies, TLS 1.0) that runs only on your own machine
An OWASP ZAP 2.17 baseline scan driven by a reusable plan file, with an HTML report you can hand to a client or developer
A Nuclei 3 scan with 11,000+ community templates, and the settings that keep it gentle on a live site
  • Kit scripts for TLS versions, certificate expiry, security headers and hidden files, plus copy-paste header fixes for Nginx, Apache, PHP, Netlify and Vercel
  • A before-and-after proof: the same scans on the fixed site
Before you start
  • A website you own, or written permission from the owner to test it. Practise on the kit's local site first
  • Python 3.9+ for the kit scripts (winget install Python.Python.3.12 on Windows)
  • Java 17 or newer for ZAP on Windows and Linux (the Mac version includes it)
  • About 1GB of disk for ZAP, Nuclei and its templates
01/07Set your scope, then start a practice target0 done
STEP 01 of 07~10 min

Set your scope, then start a practice target

Know exactly what you're allowed to scan, and have a safe target to learn on.

  1. Only your own site, or one you have written permission to testGet that permission in an email that names the domain, the dates and the kind of testing before you scan anyone else's site, a client's included.

  2. Write a one-line scope in a text file before every scan: the exact URLs, what's out of scope (payment pages, third-party services like Shopify checkout or Stripe), and when you'll run it. Your host's acceptable-use policy is worth a quick read too: some shared hosts throttle or block heavy scanning even on your own site.

  3. Start with the practice sitepractice-site.py is a tiny, deliberately sloppy bakery website that listens on 127.0.0.1 only, so nothing outside your PC can reach it. It leaks its server and PHP versions, exposes a .env file and a .git folder, sets a weak session cookie and sends no security headers. --fixed runs the hardened version on a second port for the before-and-after:

    Two terminal windows
    python practice-site.py
python practice-site.py --fixed
    Output
    Practice site (sloppy) on http://127.0.0.1:8088  (Ctrl+C to stop)

  4. The kitpractice-site.py, zap-baseline-plan.yaml, tls-check.py, check-hidden-files.ps1 and .sh with paths.txt, and security-headers.md.

✓
Checkpointhttp://127.0.0.1:8088 shows Joe's Bakery in your browser, and you've written a scope line for your own real site.
Stuck? Ask the community
Next mission · Cyber defenceMake your accounts phishing-proof with passkeys and security keys
→