{"action":"created","issue":{"url":"https://api.github.com/repos/zaproxy/zaproxy/issues/2354","repository_url":"https://api.github.com/repos/zaproxy/zaproxy","labels_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/2354/labels{/name}","comments_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/2354/comments","events_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/2354/events","html_url":"https://github.com/zaproxy/zaproxy/issues/2354","id":143981638,"number":2354,"title":"Add \"diff\" functionality to scan results to assist in finding vulnerability specifics","user":{"login":"wadeschofield","id":11203510,"avatar_url":"https://avatars.githubusercontent.com/u/11203510?v=3","gravatar_id":"","url":"https://api.github.com/users/wadeschofield","html_url":"https://github.com/wadeschofield","followers_url":"https://api.github.com/users/wadeschofield/followers","following_url":"https://api.github.com/users/wadeschofield/following{/other_user}","gists_url":"https://api.github.com/users/wadeschofield/gists{/gist_id}","starred_url":"https://api.github.com/users/wadeschofield/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wadeschofield/subscriptions","organizations_url":"https://api.github.com/users/wadeschofield/orgs","repos_url":"https://api.github.com/users/wadeschofield/repos","events_url":"https://api.github.com/users/wadeschofield/events{/privacy}","received_events_url":"https://api.github.com/users/wadeschofield/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/zaproxy/zaproxy/labels/add-on","name":"add-on","color":"006b75"},{"url":"https://api.github.com/repos/zaproxy/zaproxy/labels/enhancement","name":"enhancement","color":"84b6eb"},{"url":"https://api.github.com/repos/zaproxy/zaproxy/labels/Type-Enhancement","name":"Type-Enhancement","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":8,"created_at":"2016-03-28T13:48:55Z","updated_at":"2016-04-11T17:03:46Z","closed_at":null,"body":"Currently, when running a SQL Injection scan, ZAP claims that there is a difference when a normal request is send vs when an \"injection\" request is sent. The problem is that it is very difficult to find this difference. Providing a \"diff\" or even a line/index indicating the beginning of the difference would be extremely helpful for decoding scan results."},"comment":{"url":"https://api.github.com/repos/zaproxy/zaproxy/issues/comments/208450822","html_url":"https://github.com/zaproxy/zaproxy/issues/2354#issuecomment-208450822","issue_url":"https://api.github.com/repos/zaproxy/zaproxy/issues/2354","id":208450822,"user":{"login":"wadeschofield","id":11203510,"avatar_url":"https://avatars.githubusercontent.com/u/11203510?v=3","gravatar_id":"","url":"https://api.github.com/users/wadeschofield","html_url":"https://github.com/wadeschofield","followers_url":"https://api.github.com/users/wadeschofield/followers","following_url":"https://api.github.com/users/wadeschofield/following{/other_user}","gists_url":"https://api.github.com/users/wadeschofield/gists{/gist_id}","starred_url":"https://api.github.com/users/wadeschofield/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wadeschofield/subscriptions","organizations_url":"https://api.github.com/users/wadeschofield/orgs","repos_url":"https://api.github.com/users/wadeschofield/repos","events_url":"https://api.github.com/users/wadeschofield/events{/privacy}","received_events_url":"https://api.github.com/users/wadeschofield/received_events","type":"User","site_admin":false},"created_at":"2016-04-11T17:03:46Z","updated_at":"2016-04-11T17:03:46Z","body":"The alert info is:\nSQL Injection\nRisk: High\nConfidence: Medium\nParameter: dataTimeStamp\nAttack: 14603779660575' OR '1'='1'\nEvidence:\nCWE ID: 89\nWASC ID: 19\n\nIn scanning our application, we picked up 10 of these. I've manually\ncompared half of them in a text editor and the only difference is the max=\nparameter in the http response.\n\nIt seems to me this is a false positive but it would give me more\nconfidence in the tool if I knew what logic it was employing to declare the\nissue.\n\nOne further thought, our application parses the input and strips out any\ndata prior to submitting it to the handling methods. Because of this we\nwould return the same response for a SQL Attack and we would a normal post.\nCould this be causing the false positives?\n\n\n\n\nOn Mon, Apr 11, 2016 at 11:31 AM, thc202 <notifications@github.com> wrote:\n\n> SQL Injection scanner seems to compare just the response body.\n>\n> What's exactly the name of the alert and the other info? (the other info\n> can be obfuscated)\n>\n> —\n> You are receiving this because you authored the thread.\n> Reply to this email directly or view it on GitHub\n> <https://github.com/zaproxy/zaproxy/issues/2354#issuecomment-208402828>\n>\n"}}