On April 19 (1pm EDT / 18h00 GMT) I will be talking about some of the ideas behind Groundspeed on a SANS webcast titled “Manipulating Web Application Interfaces“.

For a long time we have used the same approach to perform input validation on web applications. We have seen some nice improvements at the client side proxy level (remember the old Achilles proxy? Now think about Burp), but the overall idea remained the same: place a client proxy between the browser and the web server, generate requests, intercept them and modify the HTTP parameters.

Why was manipulating the HTTP request such a successful idea that today we still assume it’s the natural way to test input validation? Has the context that forced that solution changed? Or in other words, are we still subject to the same limitations we were then? Those are some of the questions I want to discuss.

You can find more information including a link to register for it here.