I'm using OWASP ZAP for intercepting request to a web application, OWASP WebGoat. My break point is quite simple: 'URL', 'contains', and 'http://localhost:8080/WebGoat/start.mvc#attack/76122667/400&from=ajax'. But it never catches any XMLHttpRequest with that URL while the Developer tool in browser does it well, ie can see that request.

I'm not sure if I am missing any further configuration. Please shed a light on this.


You need to remove the '#' and everything after it. This is known as the 'fragment' (https://en.wikipedia.org/wiki/URL) and is not send by the browser, so its not present in the URL that ZAP sees.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.