I have a website that I need to scan with OWASP's ZAP tool 2.70. It previously worked as long as cookies were enabled.

The site is a .net site proxied by Apache with mod_security. It works with all major browsers such as Firefox, Waterfox, Chrome, IE, Edge, Safari and Opera.

When I browse through ZAP as a proxy I am able to access the site. When I try to use the quick start URL to attack it fails generating a 302 response. This would be a symptom of having cookies disabled. When I try the request in the Manual Request Editor it loops through a series of redirects (with the request showing a SetCookie tag in the history until I get a 400 error with this message:

Your browser sent a request that this server could not understand. The number of request header fields exceeds this server's limit.

When I raised audit logging to capture all requests what I saw was that an ASP session cookie was being appended to repeatedly.

Cookie":".ASPXANONYMOUS=_zHJef8I1AEkAAAAMDY3YTJiOTktZGFkMy00NTcwLTg0YjEtNGEzMTgwYjBlYzVi0, ASP.NET_SessionId=izjpf5ocrvlwky3q5qh0l3ul, .ASPXANONYMOUS=LiCxVgAJ1AEkAAAAMGM3NTExZWUtYjE1Ni00YzYyLWJjN2ItOTQ1NzM3ZjU5ZmQz0, ASP.NET_SessionId=xnhdcxlwgsklk44jstub0fhc, .ASPXANONYMOUS=GfmtYQUJ1AEkAAAAMWE2ZjgxYTItYWZkYy00ZDk2LWE2YjgtZTczYmMwMDUyMGU00, ASP.NET_SessionId=2swvpalf1hplhhrdhrn32t5x, .ASPXANONYMOUS=GfmtYQUJ1AEkAAAAMWE2ZjgxYTItYWZkYy00ZDk2LWE2YjgtZTczYmMwMDUyMGU00, ASP.NET_SessionId=f44l3zlb2yq2nv3dvyq01ar0, .ASPXANONYMOUS=U0G8YQUJ1AEkAAAAMzRlOWQwNzItZWYzOS00ZTIzLWI0NWUtOTFiMDlkMTE5MjRj0, ASP.NET_


Sounds like a bug - can you raise an issue for this? https://github.com/zaproxy/zaproxy/issues/new

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.