I have done a normal scan (not fuzzing) of a website using ZAP in attack mode, and it gives me several possible injections. My question is if there is any way to try to exploit these within ZAP, without using SQL map myself?

2 Answers 2


Short Answer:

No. (at least not in the versions I have worked with)

Longer Answer:

ZAP is not an exploitation tool, it is a vulnerability detection tool. You can however fuzz with ZAP to determine if SQL injection is possible but as it already detected a possible SQL injection the next step is exploiting it in order to verify if it is a true / false positive.

If this is a legitimate security assessment, what's wrong with using SQLmap or trying to exploit it manually?

  • I have tried and failed to find the injection point using sqlmap, but I was not aware it could be exploited manually. I will look into this Jan 20, 2016 at 22:03

Using the Zap browser (MITM) you can highlight the POST or GET that you wish to try to exploit, then replay it with modified inputs. In the Quick Start tab, scroll down to the bottom of the window, launch your website in the browsers there. Navigate the site, then notice the returned information. Find the specific one you with to manually exploit right click on it, choose Open/Resend with Request Editor.. There you can modify the data prior to sending.. and get back any server side response.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.