GPEN · Question #442
Which of the following best explains why you would warn to clear browser slate (history. cache, and cookies) between examinations of web servers when you've been trapping and altering values with a no
The correct answer is D. Values trapped and changed in the proxy, such as a cookie, will be stored by thebrowser and. Modified values set via a proxy - such as cookies - are persisted by the browser, and carrying them into a new test session can corrupt results or expose prior manipulation.
Question
Which of the following best explains why you would warn to clear browser slate (history. cache, and cookies) between examinations of web servers when you've been trapping and altering values with a non-transparent proxy?
Options
- AValues trapped and stored in the browser will reveal the techniques you've used toexamine
- BTrapping and changing response values is beneficial for web site testing but usingthe same
- CTrapping and changing response values is beneficial for web site testing but willcause browser
- DValues trapped and changed in the proxy, such as a cookie, will be stored by thebrowser and
How the community answered
(51 responses)- A8% (4)
- B4% (2)
- C16% (8)
- D73% (37)
Why each option
Modified values set via a proxy - such as cookies - are persisted by the browser, and carrying them into a new test session can corrupt results or expose prior manipulation.
Browser storage retains the resulting modified values, not a record of the interception technique itself, so examining stored data does not expose how the proxy was used.
The issue is not simply about reusing the same session in a general sense, but specifically about persisted altered values like cookies interfering with subsequent server tests.
Trapping and changing values does not inherently cause browser errors; the real problem is that stale or modified data persists across sessions and contaminates future tests.
When a proxy intercepts and alters HTTP responses, the browser stores those modified values locally - including cookies, cached headers, and session tokens. If you begin examining a different web server without clearing browser state, the tampered values may be transmitted to the new target, skewing test results and potentially revealing that prior responses were manipulated rather than genuine.
Concept tested: Proxy-based session state isolation in web application testing
Source: https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/06-Session_Management_Testing/02-Testing_for_Cookies_Attributes
Topics
Community Discussion
No community discussion yet for this question.