Hello all,

I'm doing a test against an IIS 6 box with session state enabled. Sessions are tracked completely server side by a url like such:

websitedotcom/(S(1ngoc045sslvlc45tazuhg45))/AppPages/address/changeaddress.aspx

or

websitedotcom//(S(j4nd2sjarzlj5ejved0irh2u))/apppages/changeaddress.aspx

So each time you visit the site, it's a new URL, also the session state tends to change during automated scans. Has anyone ran into this problem? Most automated tools break trying to scan or spider (Acunetix, Paros).


Any ideas on approach?



Edited 1 time(s). Last edit at 03/18/2010 10:16AM by bflavor2.

A representative from Acunetix said that version 6.5 does not currently support these features.

Nessus and Paros don't support it well either.

Security through obscurity wins?



Edited 3 time(s). Last edit at 03/18/2010 01:26PM by bflavor2.

mac has been doing it for years ;)