I have a web application I am wanting to fuzz. It consists of a lot of REST webservice gets/puts. I have been considering using Sulley Fuzzing Framework or its successor boofuzz.
Since the jsessionid and/or other authentication cookies change for each time the user logs into the application what is the best way to handle logging into the application and then to grab the necessary cookies.
Can I then add them as s_static parts of my sully/boo session?
Any tips / pointers to documentation would be helpful. Also if there is a better tool to use I would consider it as well.