Man-in-the-middle interceptor for application security testing

A method comprising:

• implementing, using one or more hardware processors, an interceptor for application security testing, wherein the implementing comprises:
• intercepting traffic, including one or more traffic items, between a scan engine and a target application, wherein the one or more traffic items comprise at least one of:
• a request from a scan engine implementing application security testing, wherein the request is directed to the target application;
• or
• a response from the target application via a target application server, wherein the response is responsive to one or more requests from the scan engine implementing the application security testing;
• determining that a particular traffic item of the one or more traffic items satisfies a particular traffic trigger associated with a particular traffic action comprising a manipulation to the traffic between the scan engine and the target application, wherein the particular traffic action is one of a plurality of predefined traffic actions that the interceptor is configured to perform across different scan engine versions, different scan configurations, or both;
• and
• responsive to determining that the particular traffic item satisfies the particular traffic trigger, performing the particular traffic action.

One or more non-transitory computer-accessible storage media storing program instructions that, when executed on or across one or more processors, implement at least a portion of a system that includes an interceptor for application security testing and cause the system to:

• intercept traffic, including one or more traffic items, between a scan engine and a target application, wherein the one or more traffic items comprise at least one of:
• a request from a scan engine implementing application security testing, wherein the request is directed to the target application;
• or
• a response from the target application via a target application server, wherein the response is responsive to one or more requests from the scan engine implementing the application security testing;
• determine that a particular traffic item of the one or more traffic items satisfies a particular traffic trigger associated with a particular traffic action comprising a manipulation to the traffic between the scan engine and the target application, wherein the particular traffic action is one of a plurality of predefined traffic actions that the interceptor is configured to perform across different scan engine versions, different scan configurations, or both;
• and
• responsive to determining that the particular traffic item satisfies the particular traffic trigger, perform the particular traffic action.