CAS-002 · Question #727
A new web based application has been developed and deployed in production. A security engineer decides to use an HTTP interceptor for testing the application. Which of the following problems would…
The correct answer is A. The tool could show that input validation was only enabled on the client side. An HTTP interceptor proxy sits between the browser and server, enabling a tester to inspect and modify HTTP requests before they reach the server. This most directly reveals whether input validation is enforced only on the client side.
Question
A new web based application has been developed and deployed in production. A security engineer decides to use an HTTP interceptor for testing the application. Which of the following problems would MOST likely be uncovered by this tool?
Options
- AThe tool could show that input validation was only enabled on the client side
- BThe tool could enumerate backend SQL database table and column names
- CThe tool could force HTTP methods such as DELETE that the server has denied
- DThe tool could fuzz the application to determine where memory leaks occur
How the community answered
(29 responses)- A72% (21)
- B17% (5)
- C3% (1)
- D7% (2)
Why each option
An HTTP interceptor proxy sits between the browser and server, enabling a tester to inspect and modify HTTP requests before they reach the server. This most directly reveals whether input validation is enforced only on the client side.
An HTTP interceptor allows a tester to intercept and modify form data or parameters after client-side JavaScript validation has already run, then forward the manipulated input directly to the server. If the server accepts the unvalidated or malicious input without re-validating it, this confirms that input validation exists only client-side - a critical flaw because client-side controls can be trivially bypassed by any user with an interceptor.
Enumerating backend SQL table and column names requires SQL injection techniques or error-based database fingerprinting, which is a distinct capability from what an HTTP interceptor proxy primarily provides.
Even if an interceptor modifies a request to use an HTTP method such as DELETE, the server's access control configuration will still deny that method - the interceptor cannot override server-enforced restrictions.
Detecting memory leaks requires dedicated memory profiling or fuzzing tools that observe application memory behavior over time, not HTTP traffic interception.
Concept tested: HTTP proxy testing and client-side vs server-side input validation
Source: https://owasp.org/www-project-web-security-testing-guide/
Topics
Community Discussion
No community discussion yet for this question.