I'm using OWASP ZAP for intercepting request to a web application, OWASP WebGoat. My break point is quite simple: 'URL', 'contains', and 'http://localhost:8080/WebGoat/start.mvc#attack/76122667/400&from=ajax'. But it never catches any XMLHttpRequest with that URL while the Developer tool in browser does it well, ie can see that request.

I'm not sure if I am missing any further configuration. Please shed a light on this.

1 Answer 1


You need to remove the '#' and everything after it. This is known as the 'fragment' (https://en.wikipedia.org/wiki/URL) and is not send by the browser, so its not present in the URL that ZAP sees.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .