Great post. I find the zap tool from OWASP useful for some of this stuff. https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Proje...