nerdexam
GIAC

GPEN · Question #442

Which of the following best explains why you would warn to clear browser slate (history. cache, and cookies) between examinations of web servers when you've been trapping and altering values with a no

The correct answer is D. Values trapped and changed in the proxy, such as a cookie, will be stored by thebrowser and. Modified values set via a proxy - such as cookies - are persisted by the browser, and carrying them into a new test session can corrupt results or expose prior manipulation.

Web Application Penetration Testing

Question

Which of the following best explains why you would warn to clear browser slate (history. cache, and cookies) between examinations of web servers when you've been trapping and altering values with a non-transparent proxy?

Options

  • AValues trapped and stored in the browser will reveal the techniques you've used toexamine
  • BTrapping and changing response values is beneficial for web site testing but usingthe same
  • CTrapping and changing response values is beneficial for web site testing but willcause browser
  • DValues trapped and changed in the proxy, such as a cookie, will be stored by thebrowser and

How the community answered

(51 responses)
  • A
    8% (4)
  • B
    4% (2)
  • C
    16% (8)
  • D
    73% (37)

Why each option

Modified values set via a proxy - such as cookies - are persisted by the browser, and carrying them into a new test session can corrupt results or expose prior manipulation.

AValues trapped and stored in the browser will reveal the techniques you've used toexamine

Browser storage retains the resulting modified values, not a record of the interception technique itself, so examining stored data does not expose how the proxy was used.

BTrapping and changing response values is beneficial for web site testing but usingthe same

The issue is not simply about reusing the same session in a general sense, but specifically about persisted altered values like cookies interfering with subsequent server tests.

CTrapping and changing response values is beneficial for web site testing but willcause browser

Trapping and changing values does not inherently cause browser errors; the real problem is that stale or modified data persists across sessions and contaminates future tests.

DValues trapped and changed in the proxy, such as a cookie, will be stored by thebrowser andCorrect

When a proxy intercepts and alters HTTP responses, the browser stores those modified values locally - including cookies, cached headers, and session tokens. If you begin examining a different web server without clearing browser state, the tampered values may be transmitted to the new target, skewing test results and potentially revealing that prior responses were manipulated rather than genuine.

Concept tested: Proxy-based session state isolation in web application testing

Source: https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes

Topics

#web proxy#browser cookies#HTTP interception#web testing methodology

Community Discussion

No community discussion yet for this question.

Full GPEN Practice