1

I'm using OWASP ZAP for intercepting request to a web application, OWASP WebGoat. My break point is quite simple: 'URL', 'contains', and 'http://localhost:8080/WebGoat/start.mvc#attack/76122667/400&from=ajax'. But it never catches any XMLHttpRequest with that URL while the Developer tool in browser does it well, ie can see that request.

I'm not sure if I am missing any further configuration. Please shed a light on this.

Improve this question

1 Answer 1

Reset to default
1

You need to remove the '#' and everything after it. This is known as the 'fragment' (https://en.wikipedia.org/wiki/URL) and is not send by the browser, so its not present in the URL that ZAP sees.

Improve this answer
2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .