Dynamic web testing tools, such as OWASP ZAP, Arachni, Wapiti and W3af, normally provide two modes of security testing: proactive mode and proxy mode. The proactive mode means that you launch the testing tools and perform security testing directly on the web services. The tester may decide on the types of security testing (such as XSS or SQLi) of the target web service. However, the key disadvantage of this kind of testing is that you could miss certain permission-required web pages, or web pages that may require the right order of page visits. The following diagram shows the approach of proactive mode:
The proxy mode, which can also be understood as MITM, means that the security testing tool is running as a proxy and intercepting traffic between the browser client and the target web services. In the proxy mode, the security...