I'm trying to find SQL injection vulnerability in DVWA with OWASP ZAP. After some clicking through the page I have a small site map:

enter image description here

I ran Active scan, Spider and AJAX spider on the GET:sqli node. As you can see in the screenshot above, SQL injection vulnerability was not found. Neither was the form action from the https://localhost:8081/vulnerabilities/sqli/ page:

enter image description here

Only if I manually submit the form, the form action shows up in the Sites tab:

enter image description here

And only if I run Active scan again, the SQL Injection vulnerability is detected.

enter image description here

Is there any way to force spider / active scan to submit forms and detect their vulnerabilities automatically?

1 Answer 1


By default the ZAP spiders do submit forms, although you can turn this off for the traditional spider. Likewise the active scanner will by default attack both GET and POST requests, but again this is configurable. Why it didnt in this case is another matter, and would require more investigations. The ZAP User Group might be a better forum to help investigate this: https://groups.google.com/group/zaproxy-users

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .