21. Web Application Testing Tools
21.1 How Web Testing Works: The Intercepting Proxy
Browser aani server madhe HTTP requests-responses jatat (Chapter 2 madhe shiklo). Ek intercepting proxy madhe basto aani pratyek request thambavto, dakhavto, badalu deto, mag pathavto. Hech web testing cha hriday aahe – karan browser che validation baju la sarun tumhi server la thet kahihi pathavu shakta.
Browser -> Intercepting proxy (Burp/ZAP) -> Web server
you can read and change every request here
Why this matters: a website may hide a button or check a price in JavaScript, but the real security must be on the server. With a proxy you send the request the browser never would – that is how you find broken access control, IDOR and injection.
Ravindra Bagale's Tip
Students samajtat ki client-side (JavaScript) validation mhanje security. Nahi! Proxy ne to purna baju la jato. Nehmi lakshat theva: server var validate kela nahi, tar security nahi. Chapter 16 chya reels app madhe tumhi server-side check thevla hota – ithe kalel ka to garjecha hota.
Practice task
Draw the browser–proxy–server path in your notes and write one line: why is server-side validation the only real security? Give an example from your own reels app.