OWASP ZAP submit forms

Question

I'm trying to find SQL injection vulnerability in DVWA with OWASP ZAP. After some clicking through the page I have a small site map:

I ran Active scan, Spider and AJAX spider on the GET:sqli node. As you can see in the screenshot above, SQL injection vulnerability was not found. Neither was the form action from the https://localhost:8081/vulnerabilities/sqli/ page:

Only if I manually submit the form, the form action shows up in the Sites tab:

And only if I run Active scan again, the SQL Injection vulnerability is detected.

Is there any way to force spider / active scan to submit forms and detect their vulnerabilities automatically?

Answer 1

By default the ZAP spiders do submit forms, although you can turn this off for the traditional spider. Likewise the active scanner will by default attack both GET and POST requests, but again this is configurable. Why it didnt in this case is another matter, and would require more investigations. The ZAP User Group might be a better forum to help investigate this: https://groups.google.com/group/zaproxy-users