In http-fundamentals you learned what an HTTP request contains. A browser Network panel can show you what the browser already sent, but it cannot change anything in flight. An intercepting proxy turns that window into a control room — it sits between your browser and the server and lets you pause a request, read every byte, modify any part, and replay it on demand.
This is the most important tool in web application testing. Most later vulnerability lessons are, mechanically, requests you can modify and replay inside a proxy.
In this lesson you will:
- Install an intercepting proxy — Burp Suite Community Edition or OWASP ZAP (both are free) — and route your browser through it.
- Install the proxy's CA certificate so it can read HTTPS traffic without certificate errors.
- Intercept a real NovaCart request, modify it, and replay it from Repeater (Burp) or the Manual Request Editor (ZAP).
- See first-hand why client-side validation is not a security control: the proxy rewrites the request after the browser's own checks have run.
The two tools use the same concepts under different menu names; this lesson gives Burp's term first and ZAP's in parentheses.
A word of scope before you begin: an intercepting proxy decrypts and rewrites traffic, so you point it only at targets you are authorized to test — here, the bundled lab. Pointing it at someone else's session is exactly the unauthorized access hacking-ethics-and-authorization warned against.
Prerequisites: http-fundamentals (HTTP request structure and methods) and hacking-ethics-and-authorization (authorized testing scope).
Estimated time: 15 to 25 minutes, most of it one-time setup.
When you are ready, send the Continue signal.