21. Web Application Testing Tools
21.1 How Web Testing Works: The Intercepting Proxy
Browser aani server madhe HTTP requests-responses jatat (Chapter 2 madhe shiklo). Ek intercepting proxy madhe basto aani pratyek request thambavto, dakhavto, badalu deto, mag pathavto. Hech web testing cha hriday aahe – karan browser che validation baju la sarun tumhi server la thet kahihi pathavu shakta.
Browser -> Intercepting proxy (Burp/ZAP) -> Web server
you can read and change every request here
Why this matters: a website may hide a button or check a price in JavaScript, but the real security must be on the server. With a proxy you send the request the browser never would – that is how you find broken access control, IDOR and injection.
Ravindra Bagale's Tip
Students think client-side (JavaScript) validation means security. No! A proxy bypasses it completely. Always remember: if it is not validated on the server, there is no security. In the Chapter 16 reels app you kept a server-side check – here you will see why it was needed.
Ravindra Bagale's Tip – मराठी
Students समजतात की client-side (JavaScript) validation म्हणजे security. नाही! Proxy ने तो पूर्ण बाजूला जातो. नेहमी लक्षात ठेवा: server वर validate केलं नाही, तर security नाही. Chapter 16 च्या reels app मध्ये तुम्ही server-side check ठेवला होता – इथे कळेल तो का गरजेचा होता.
Ravindra Bagale's Tip – हिंदी
Students समझते हैं कि client-side (JavaScript) validation ही security है. नहीं! Proxy से वह पूरी तरह bypass हो जाता है. हमेशा याद रखो: server पर validate नहीं किया, तो security नहीं. Chapter 16 के reels app में तुमने server-side check रखा था – यहाँ समझ आएगा कि वह क्यों ज़रूरी था.
Practice task
Draw the browser–proxy–server path in your notes and write one line: why is server-side validation the only real security? Give an example from your own reels app.