A new web based application has been developed and deployed in production. A security engineer decides to use an HTTP interceptor for testing the application. Which of the following problems would…

An HTTP interceptor such as Burp Suite captures the raw HTTP request after the browser's JavaScript validation has already run. A tester can then modify field values that the client-side code would have rejected and resend the manipulated request directly to the server. If the server accepts the modified input, it confirms that validation is enforced only on the client side, exposing a critical security flaw.

Enumerating backend SQL table and column names requires active SQL injection exploitation or database error analysis, which goes beyond what simple HTTP interception reveals.

If the server has already been configured to deny certain HTTP methods, replaying those methods through an interceptor will still result in denial - the interceptor reveals the configuration but cannot force the server to accept blocked methods.

Identifying memory leaks requires a dedicated fuzzer or memory analysis tool; an HTTP interceptor observes and replays traffic but does not instrument application memory.