What is an intercepting proxy, and why is it a core tool of web-application security testing?
A tool that sits between your browser and the server as a proxy you control, so you can see — and pause, edit, or replay — every HTTP(S) request and response instead of only what the page chooses to show.
* All browser traffic routes through the proxy, giving the tester a live, editable view of every request and response. *
A browser normally hides the raw traffic: you see rendered pages, not the exact bytes on the wire. An intercepting proxy is configured as the browser's proxy, so all traffic flows through it and the tester gets a live, editable view:
- Inspect every request and response — headers, cookies, parameters, bodies.
- Intercept — hold a request before it reaches the server and change it (a price, a user ID, a hidden field) to see how the server reacts.
- Replay / fuzz — resend a captured request many times with altered values to hunt for injection, broken access-control, and logic flaws.
Common tools: Burp Suite, OWASP ZAP, mitmproxy, Fiddler.
Tip: The whole value is control of the client side. The server can't tell an edited request from a genuine one, so anything the browser was trusted to enforce (client-side validation, a hidden price) becomes yours to change.
Go deeper:
Burp Proxy — PortSwigger documentation — the reference intercepting proxy: intercept, inspect, and modify traffic both ways.
Proxy server (Wikipedia) — proxies in general, including intercepting/transparent variants.- Burp Suite (Wikipedia) — the best-known web-app security testing suite built around this proxy.