Welcome to the part of the internet where
HTTP requests go to die.
We intercept.
We modify.
We break.
A browser sends a request. A server responds. Simple. Until someone starts changing the request.
The clown has studied the OWASP Top 10. Have you?
Users accessing things they shouldn't.
Sensitive data exposed through weak protection.
SQL, command and other untrusted input attacks.
Security problems built into the architecture.
Defaults, exposed services and bad configuration.
Dependencies with known security weaknesses.
Weak authentication, sessions and credentials.
Untrusted updates, plugins and pipelines.
Attacks happen while nobody is watching.
The server becomes your proxy.
The browser trusts the application. The application trusts the input. The clown trusts absolutely nobody.
Never trust user input. Especially when the user looks like this clown.
Learn the vulnerability.
Understand the request.
Fix the damn thing.