I'm trying to find SQL injection vulnerability in DVWA with OWASP ZAP. After some clicking through the page I have a small site map:
I ran Active scan, Spider and AJAX spider on the
GET:sqli node. As you can see in the screenshot above, SQL injection vulnerability was not found. Neither was the form action from the
Only if I manually submit the form, the form action shows up in the Sites tab:
And only if I run Active scan again, the SQL Injection vulnerability is detected.
Is there any way to force spider / active scan to submit forms and detect their vulnerabilities automatically?