Hands-On Security in DevOps

Web testing in proactive/proxy mode

Dynamic web testing tools, such as OWASP ZAP, Arachni, Wapiti and W3af, normally provide two modes of security testing: proactive mode and proxy mode. The proactive mode means that you launch the testing tools and perform security testing directly on the web services. The tester may decide on the types of security testing (such as XSS or SQLi) of the target web service. However, the key disadvantage of this kind of testing is that you could miss certain permission-required web pages, or web pages that may require the right order of page visits. The following diagram shows the approach of proactive mode:

The proactive mode

The proxy mode, which can also be understood as MITM, means that the security testing ...