Cannot test Session Fixation against specific applications
Open
Nobody has claimed this yet.
Priority-Medium
Type-Defect
- Dominant language
- Java
- Stars
- 15.8k
- Forks
- 2.6k
- Avg merge
- 13h 16m
- Merged PRs (30d)
- 17
Description
What steps will reproduce the problem?
1. Prepare a Web application that has the following characteristics:
- When logging in to the app without a session cookie, it returns the status code 400
and new session cookie.
* e.g. web applications of CakePHP
2. Log in to the application manually.
3. Register the url as a Login URL
4. Do an active scan against the Login URL on Site tab to check Session Fixation.
What is the expected output? What do you see instead?
I expect to be judged after the second access, but it ends before the second access.
What version of the product are you using? On what operating system?
ZAP v2.2.2
Please provide any additional information below.
I think it's better to use the GET method for the first access.
Original issue reported on code.google.com by yukisov on 2014-04-09 10:30:49
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file, test, or entry point is named in the issue. Reproduce the active scan against an application that returns status 400 and a new session cookie when logging in without one, then trace the Session Fixation check from the registered Login URL. Done means the scan performs and evaluates the second access instead of ending after the first.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100