Scenario: A test server has a deployed build on there ready for testing, can i use burpsuite/ZAP on my local computer if the server is on the same network? Am i somehow skewing the results and the data i see inside the request / responses and they would not replicate the production environment where the client does not reside In the same domain as the server? If so what kind of impacts would this have across TLS etc and the data my client receives, if any, would i have access to non encrypted data?

Would a client on the same network as the webserver able to retrieve more sensitive data through the proxy than a client accessing the webserver from their home/externally

  • Web servers operate at the application layer and will serve the same contents no matter from which IP address it is accessed (unless the application is specifically coded to operate otherwise). Therefore, no matter if you access the server from the same subnet or across the continent, the web server shouldn't feel any difference.
    – void_in
    Aug 8 '17 at 5:06
  • Except that TLS does not operate on the application layer, but on the session layer. Depending on the infrastructure I can imagine that there are load balancers present that perform TLS offloading, perhaps an internal CA for certificates that are used on your web servers and such things. Testing from the internal network could give a different result when it comes to the configuration of TLS. However, without knowing these factors it is hard to properly answer the question related to TLS. Like @void_in said, the application should be the same, no matter where the end user is located.
    – Jeroen
    Aug 8 '17 at 5:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.