I have a website that I need to scan with OWASP's ZAP tool 2.70. It previously worked as long as cookies were enabled.

The site is a .net site proxied by Apache with mod_security. It works with all major browsers such as Firefox, Waterfox, Chrome, IE, Edge, Safari and Opera.

When I browse through ZAP as a proxy I am able to access the site. When I try to use the quick start URL to attack it fails generating a 302 response. This would be a symptom of having cookies disabled. When I try the request in the Manual Request Editor it loops through a series of redirects (with the request showing a SetCookie tag in the history until I get a 400 error with this message:

Your browser sent a request that this server could not understand. The number of request header fields exceeds this server's limit.

When I raised audit logging to capture all requests what I saw was that an ASP session cookie was being appended to repeatedly.

Cookie":".ASPXANONYMOUS=_zHJef8I1AEkAAAAMDY3YTJiOTktZGFkMy00NTcwLTg0YjEtNGEzMTgwYjBlYzVi0, ASP.NET_SessionId=izjpf5ocrvlwky3q5qh0l3ul, .ASPXANONYMOUS=LiCxVgAJ1AEkAAAAMGM3NTExZWUtYjE1Ni00YzYyLWJjN2ItOTQ1NzM3ZjU5ZmQz0, ASP.NET_SessionId=xnhdcxlwgsklk44jstub0fhc, .ASPXANONYMOUS=GfmtYQUJ1AEkAAAAMWE2ZjgxYTItYWZkYy00ZDk2LWE2YjgtZTczYmMwMDUyMGU00, ASP.NET_SessionId=2swvpalf1hplhhrdhrn32t5x, .ASPXANONYMOUS=GfmtYQUJ1AEkAAAAMWE2ZjgxYTItYWZkYy00ZDk2LWE2YjgtZTczYmMwMDUyMGU00, ASP.NET_SessionId=f44l3zlb2yq2nv3dvyq01ar0, .ASPXANONYMOUS=U0G8YQUJ1AEkAAAAMzRlOWQwNzItZWYzOS00ZTIzLWI0NWUtOTFiMDlkMTE5MjRj0, ASP.NET_

1 Answer 1


Sounds like a bug - can you raise an issue for this? https://github.com/zaproxy/zaproxy/issues/new

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .