YanoSec
Progress0 of 152 lessons complete

Course / 08 Tools / Lesson 03 of 06

A proxy: Burp Suite or OWASP ZAP

Estimated time: 18 min reading · 14 min activity

A browser normally sends its request toward a server. An intercepting proxy sits between them and can hold a message for inspection before releasing it. Intercept means pause in that path. A waiting browser may therefore be waiting for the proxy rather than for a broken server.

Burp Suite calls its request-release control Forward. Turning intercept off allows later matching traffic to pass without the pause. ZAP uses Step to release a trapped message while keeping its global break, and Continue to release it and clear that break. A global break is its general pause setting. You will reason from these controls on an authored HTTP model, without starting either application.

Before you begin

Estimated time
18 min reading, 14 min activity. Setup and optional practice may take longer.
Where you work
Use the printed examples in any desktop or mobile browser, with paper or a text editor. No installation, account, proxy, certificate or scan is required. Ubuntu is sufficient for later practice; optional setup time is outside these estimates.
Without a lab
All evidence needed for the activity appears on this page. Copy it into notes if downloads are unavailable. Read the labeled model and predict each result; a paper trace practises the reasoning while tool operation waits for a lab. Reading needs no JavaScript. Answer checking needs JavaScript and a secure context; saving progress also needs usable browser storage.

After this lesson you can:

  • Read method, path, host and port from an HTTP request fragment.
  • Distinguish releasing a held message from changing browser cookies.
  • Plan isolated proxy setup and complete cleanup for later practice.

01Example

Authored request fragment and state model. It is sufficient to read routing and hold state; it is not a captured message or a complete transmitted request.

GET /note HTTP/1.1
Host: 127.0.0.1:8000
State: held at the proxy
Action in the worked Burp model: Forward
Predicted next state: this request is released toward the owned server.

02Hold, send, replay, and undo

GET is the request method and /note is the path. HTTP/1.1 identifies the protocol version. Host names the intended server; :8000 supplies its port. The address 127.0.0.1 is loopback, this machine. The proxy’s own listener is a separate endpoint, commonly port 8080. Confusing listener and destination ports would route the request incorrectly.

Replay means sending a request again. Burp Repeater can resend an existing request, but a repeat may have effects on the server; scope must allow both the target and action. Reading two identical GET /desk fragments lets you recognize a replay without sending either.

For optional later live work, use a disposable guest and a browser launched by the proxy. Confirm the proxy listener stays on loopback and the target grant names only the owned HTTP service on port 8000. Keep personal tabs and accounts out of that browser. HTTPS interception would also require a trusted lab certificate authority, a CA that signs substitute certificates; use a dedicated browser profile and remove that trust afterward. Plain HTTP here needs no CA. If localhost bypasses a manual proxy setting, stop and consult that product’s browser guide rather than changing your everyday browser.

Teardown reverses the setup: release or drop any held message deliberately, turn intercept or the global break off, clear a manually configured lab proxy or close the proxy-launched browser, remove any lab CA from that dedicated trust store, then quit the proxy. Confirm a later lab session has no listener you left running. Record uncertain cleanup and stop; do not browse personal sites to test it.

Trace a held HTTP request through a proxy, then plan cleanup of an isolated lab browser.Model. A teaching model drawn by hand. It shows the idea, not real tool output.

Read the full explanation below.

Playback is optional. Step through at your own pace.

BrowserCleanup is not yet established.
ProxyNo server delivery established while held.
Owned serverOwned destination 127.0.0.1:8000; no response was received.
  1. Browser → ProxyGET /note HTTP/1.1Host: 127.0.0.1:8000; supplied request held at proxy.
  2. Proxy → Owned serverForwardPredicted release toward the owned server; no observed reply.
Hold or release the supplied request
pending

The supplied request is held at the proxy.

Follow the explanation

  1. The supplied request is held at the proxy.
  2. Forward models release toward the server.
Read every state and value

1. The supplied request is held at the proxy.

Messages shown
held
Current message
held
Policy decisions
Status: pending
Participant roles
Actor: Browser; Text: Cleanup is not yet established. · Actor: Proxy; Text: No server delivery established while held. · Actor: Owned server; Text: Owned destination 127.0.0.1:8000; no response was received.

2. Forward models release toward the server.

Messages shown
held · Forward
Current message
Forward
Policy decisions
Status: permitted-model
Participant roles
Actor: Browser; Text: Cleanup: restore the browser proxy setting and stop the proxy after the exercise; not performed here. · Actor: Proxy; Text: Holds the supplied request until Forward models release. · Actor: Owned server; Text: No response or replay result supplied.
A held request has not reached the server; releasing and cleanup are distinct steps, represented only as a model.

03Read the activity request

The activity uses GET /desk to 127.0.0.1:8000. Its stated grant permits reading the owned page only. Use the printed request and cleanup checklist.

Original request model. No proxy was started. No browser was configured.
No certificate was installed. No response was received.

Grant
Target: 127.0.0.1, port 8000 only
Allowed action: read the owned desk page
Excluded: any other host, any scan, the school portal
Stop: if the grant does not match, do not send the request

Worked model
GET /note HTTP/1.1
Host: 127.0.0.1:8000

State: held at intercept. The server has not received it yet.
Burp's control that sends a held request is Forward.
ZAP's Step sends the trapped message and leaves the global break set.
ZAP's Continue sends it and turns that global break off.
ZAP's Drop does not send it.
Deleting cookies does not send it.
Predicted after a send: the server would see this one request. Not observed.

Activity model
GET /desk HTTP/1.1
Host: 127.0.0.1:8000

Check: method GET, path /desk, host 127.0.0.1, port 8000.

Replay of that same request
GET /desk HTTP/1.1
Host: 127.0.0.1:8000

The second copy has the same request line. That is one replay, still inside the grant.
A request aimed at another host would leave the grant.

Predicted status if the Stage 06 loopback server were serving an existing file: 200.
That status reuses the Stage 06 success model. It was not observed here.

Field model
POST /time HTTP/1.1
Host: 127.0.0.1:8000

State: held. The lab browser is waiting.

Download the request model

Later isolated lab proxy cleanup. No live proxy is required for the printed activity.

1. Deliberately release or drop held lab messages; turn Burp intercept off or unset ZAP global break.
2. Clear a manually configured proxy in the dedicated lab browser, or close the browser launched by the proxy.
3. Remove any lab CA trust from that dedicated profile. The plain HTTP model needs no CA. Keep everyday browser settings unchanged.
4. Quit the proxy application.
5. Confirm no listener started for the session remains. If uncertain, stop and record the remaining configuration before using that profile again.

Download the cleanup checklist

  1. Underline the method and path on the first line. Underline host and port on the Host line. Your notes should read GET, /desk, 127.0.0.1 and 8000.
  2. Compare the repeated request fragment with the first. The same method, path and destination show one replay in this paper model. No response is supplied, so leave success unconfirmed.
  3. Write a before/after setup note: dedicated lab browser and loopback proxy before; browser proxy cleared or tool browser closed, intercept off, any lab CA removed, program stopped afterward.
  4. Stop after the note. Do not start a proxy or send the later independent POST /time case to complete this lesson.

04Optional challenge

For about ten optional minutes, change only the destination in a copy of the paper request to a host outside the stated grant. Explain why recognizing a valid HTTP request is different from having permission to send it. Keep the copy in notes; do not send it.

05Fresh cases for the checks

Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.

Proxy case A: held fragment, never transmittedOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

POST /label HTTP/1.1
Host: 127.0.0.1:8000
Proxy listener: 127.0.0.1:8080
State: held. Grant: GET /label to the owned port 8000 only; no POST.
Drop discards a held request. Forward releases it. Cookie deletion does neither.

Proxy case B: independent cleanup planOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.

Later hypothetical lab used a dedicated browser with a manual proxy and a lab CA.
The written teardown requires: resolve held messages, disable intercept, clear the lab browser proxy, remove lab CA trust, then quit the proxy.
Do not perform setup or cleanup on a real browser for these checks.

06Explain your evidence

Optional written self-check: explain one decision using the supplied case. No tool run is required.

Check your explanation: cite method, path, destination and held state; compare the full grant; explain queue actions separately from cookies; include routing, interception and certificate trust in the later cleanup plan.

07Common mistakes

If the modeled browser waits, trace the held-state line before blaming the server. Cookie deletion changes browser state and does not operate a proxy’s held-message queue.

If a later lab browser cannot reach loopback through the proxy, stop and inspect that browser’s documented bypass settings. Do not widen the target scope or alter your personal profile.

If cleanup leaves certificate trust behind, remove the lab CA from the dedicated profile before reusing it. A CA is authority to validate certificates, not an ordinary page bookmark.

References