She configured her browser’s local proxy to 127.0.0.1:8080 . Turned off "intercept." Clicked the bank’s login link. In the "Target" tab, the site’s hierarchy appeared—a tree of endpoints, cookies, and parameters.
Then she turned interception on .
The tool was free. The lesson—priceless.
Her heart thumped. That meant the server wasn’t recalculating it per request. It was trusting the client.
She clicked the "Login" button with dummy credentials: user: test , pass: 1234 .