Any guidance on how can I test Session hihajacking, Session Fixation test cases on ZAP?

[Salman Khwaja]

Any guidance on how can I test Session hijacking, Session Fixation test cases on ZAP with two users ?

[kingthorin+owaspzap]

Get Active Scan Rules (Beta) from the Marketplace:

https://github.com/zaproxy/zap-extensions/wiki/HelpAddonsAscanrulesBetaAscanbeta#session-fixation

Include the "Session Fixation" active scanner in your scan policy.

[kingthorin+owaspzap]

Also in your Passive Scan rules make sure you've enabled: Session ID In URL Rewrite
https://github.com/zaproxy/zap-core-help/wiki/HelpAddonsPscanrulesPscanrules#session-id-in-url-rewrite

Lastly, the OWASP Testing Guide provides guidance on manual testing as well:
https://www.owasp.org/index.php/Testing_for_Session_Fixation_(OTG-SESS-003)
https://www.owasp.org/index.php/Testing_for_Session_puzzling_(OTG-SESS-008)