I just started learning the OWASP ZAP Proxy using Webgoat. I am running these on my Mac.

I have configured Zap to listen to my Firefox, but I'm only able to send HTTP GET requests, there are no POST requests showing up.

I also tried to use the Firefox add-on Tamper Data, and I also get no POST results.

When I tried the same task on my Windows desktop, it works fine.

Zap with no Post showing

  • On the top left pane, it appears there's a request marked "POST". Is that an old request or the one you're looking for?
    – Ohnana
    Jan 28, 2016 at 16:01
  • I believe this may be due to the form on each environment. On your Mac machine, your vulnerable application may only be accepting GET requests, where on Windows, your application is only accepting POST requests. For example: <form action="hack-me.php" method="get"> vs. <form action="hack-me.php" method="post">. See if you can change the vulnerable value from GET to POST, and let us know. Otherwise, you may be missing an option somewhere. Jan 28, 2016 at 17:51
  • @Ohnana It is the post request I got when I login to webgoat, and its the only post I get.
    – Z.Zhe
    Jan 29, 2016 at 17:09
  • Maybe you're not making any more post requests then? Jan 30, 2016 at 12:04


You must log in to answer this question.

Browse other questions tagged .