Comparing multiple HTTP responses in OWASP ZAP

Viewed 74
1 Answers

When you setup ZAP's fuzzer setup the username payloads, goto the "Message Processors" tab. Remove "Payload Reflection Detector". Add "Tag Creator", set it to "Extract" set the "Regex" as warning>(Invalid.*)<. Run the fuzzer. Sort the results by the "State" column. Note one of the results is subtly different.

Related