Embed Notice

To be safe I even wasted my time checking the server itself and the entire stack has literally zero interaction with the query string whatsoever.

I'm mainly angry due to the absurd "high" confidence ZAP is assigning the flag.

First: ZAP has no knowledge of the server's implementation. There's no way to tell a "blind" injection even exists.

Second: The evidence something bad happened is NOTHING. It's just as likely the input didn't do anything.

Third: Response time was unchanged