OWASP ZAP 11 Tutorial: Fuzzer, SQL Injection, and XSS Explained

How to user Fuzzer or Fuzzing in OWASP ZAP for SQL Injection and Cross Site Scripting (XSS)
Fuzz feature helps to apply zap provided payloads for SQL injection and XSS
OWASP ZAP 10 | Contexts, Scope and Modes in ZAP
• OWASP ZAP 10 Tutorial:...
OWASP ZAP 07 | Manual Explore and Active Scan on ZAP
• OWASP ZAP 07 Tutorial:...

[@ricardoclaus8807]

Very good!

[@SanQAMastery]

Thank you! Cheers!

[@Bla_ck_LA_Goon]

thank you 🎉🎉🎉

[@akshayas5393]

Reflected status showing on application on fuzzer result. But incorrect validation is showing while try to login via script. Is my application vulnerable to SQL injection?

[@SanQAMastery]

Reflected status alone doesn’t confirm SQL injection vulnerability, but it is a signal that you should investigate further. Manual testing and reviewing how inputs are handled in your application code are crucial steps in determining if your application is indeed vulnerable to SQL injection.
Look for detailed error messages or behavior changes that indicate SQL injection. For instance, if your application exposes database errors, that could be a sign.
If it displays a message such as 'Invalid credentials,' then there is no issue. In this case also the status should be Reflected.
Thank You.

[@Toxic_Talons]

use nuclei templates , burpsuite ,arjun ,ghauri ,paramspider to find parameters and sqlmap with tamper script if ur waf will get bypass shittt is vunarable