I have a website that I need to scan with OWASP's ZAP tool 2.70. It previously worked as long as cookies were enabled.
The site is a .net site proxied by Apache with mod_security. It works with all major browsers such as Firefox, Waterfox, Chrome, IE, Edge, Safari and Opera.
When I browse through ZAP as a proxy I am able to access the site. When I try to use the quick start URL to attack it fails generating a 302 response. This would be a symptom of having cookies disabled. When I try the request in the Manual Request Editor it loops through a series of redirects (with the request showing a SetCookie tag in the history until I get a 400 error with this message:
Your browser sent a request that this server could not understand. The number of request header fields exceeds this server's limit.
When I raised audit logging to capture all requests what I saw was that an ASP session cookie was being appended to repeatedly.
Cookie":".ASPXANONYMOUS=_zHJef8I1AEkAAAAMDY3YTJiOTktZGFkMy00NTcwLTg0YjEtNGEzMTgwYjBlYzVi0, ASP.NET_SessionId=izjpf5ocrvlwky3q5qh0l3ul, .ASPXANONYMOUS=LiCxVgAJ1AEkAAAAMGM3NTExZWUtYjE1Ni00YzYyLWJjN2ItOTQ1NzM3ZjU5ZmQz0, ASP.NET_SessionId=xnhdcxlwgsklk44jstub0fhc, .ASPXANONYMOUS=GfmtYQUJ1AEkAAAAMWE2ZjgxYTItYWZkYy00ZDk2LWE2YjgtZTczYmMwMDUyMGU00, ASP.NET_SessionId=2swvpalf1hplhhrdhrn32t5x, .ASPXANONYMOUS=GfmtYQUJ1AEkAAAAMWE2ZjgxYTItYWZkYy00ZDk2LWE2YjgtZTczYmMwMDUyMGU00, ASP.NET_SessionId=f44l3zlb2yq2nv3dvyq01ar0, .ASPXANONYMOUS=U0G8YQUJ1AEkAAAAMzRlOWQwNzItZWYzOS00ZTIzLWI0NWUtOTFiMDlkMTE5MjRj0, ASP.NET_
