1

I'm trying to fuzz wordpress post password fuctionality with my lists of password. Unfortunately, when fuzzing password page with correct password, and setting redirections to true, ZAP does not display logged in page. Instead it displays regular enter password page.

I suspect it is due to incorrect handling of cookies with redirects/responses in ZAP. Same configuration in burp suite does result in displaying success page.

wordpress postpass (password protected pages) cookies are created in manner that randomizes ending of the cookie name:

postpass_WW5cXX45EE274XX6bdYY90ZZ1950WWW2

How can I set ZAP to correctly handle cookies, so after successful password fuzz I will be redirected to the target page?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.