Certified Ethical Hacker (CEH) Practice Question

Client-side JavaScript validation can be bypassed because an attacker can alter the HTTP request after the browser has performed its checks. Capturing the POST request in an intercepting proxy such as Burp Suite or OWASP ZAP and modifying the price parameter before forwarding lets the tester observe whether the server enforces its own validation. If the transaction succeeds at the altered price, the server relies solely on client-side controls and is vulnerable. Simply deleting cookies or clearing cache does not affect the parameter. SQL injection targets database queries, not the integrity of a numeric field. Loading the page without JavaScript only prevents the form from submitting; it does not actively test server-side validation. Therefore, intercepting and editing the request is the correct technique for bypassing and testing client-side controls.