What sits between a browser and an internet connection and alters requests and responses in a way the developer did not intend?

An intercept proxy is a software tool that functions as a man-in-the-middle, positioning itself between a user's browser and the web server. It captures all HTTP/S traffic, allowing a security analyst or developer to inspect, modify, and replay requests and responses. This capability is essential for dynamic application security testing (DAST), as it enables the discovery of vulnerabilities by manipulating data in transit in ways the original developer did not intend or foresee. Common examples of such tools include OWASP ZAP and PortSwigger's Burp Suite.

A. Load testing is a performance testing technique used to measure a system's behavior under a high, simulated user load, not to alter individual requests for security analysis.

B. Input validation is a security control implemented within the application's code to sanitize and check data from users, not an external tool that intercepts traffic.

D. Reverse engineering is the process of deconstructing a compiled application to understand its internal logic, not a method for intercepting live network communications.

---

1. OWASP Zed Attack Proxy (ZAP) Project. In the official documentation, ZAP is explicitly defined by its core function: "At its core, ZAP is a ‘man-in-the-middle proxy’. It stands between the tester’s browser and the web application so that it can intercept and inspect all of the traffic."

Source: OWASP Foundation, "Introduction," ZAP Documentation. Retrieved from https://www.zaproxy.org/docs/desktop/start/introduction/ (Section: "What is ZAP for?")

2. PortSwigger Ltd. Documentation. The official documentation for Burp Suite, a leading web security testing tool, describes its proxy component: "Burp Proxy is an intercepting web proxy that lets you see and modify the traffic that passes between your browser and the target web application."

Source: PortSwigger Ltd., "What is Burp Proxy?," Burp Suite Documentation. Retrieved from https://portswigger.net/burp/documentation/desktop/tools/proxy (Paragraph 1).

3. MIT OpenCourseWare. In the lecture materials for a computer systems security course, the use of intercepting proxies is described as a fundamental technique for web security analysis. The notes explain how tools like Burp Suite are used to "intercept and modify requests" to test for vulnerabilities.

Source: Frans Kaashoek, Nickolai Zeldovich, "Lecture 10: Web Security," 6.858 Computer Systems Security, Fall 2014, Massachusetts Institute of Technology: MIT OpenCourseWare. Retrieved from https://ocw.mit.edu/courses/6-858-computer-systems-security-fall-2014/resources/lecture-10-web-security/ (Section: "Attacks on web applications").