I would like to know if intercepting and modifying requests using Burpsuite before reaching server is considered as vulnerability.
In our web based and mobile applications, adequate security measures are in place to avoid replay attack and data integrity etc.,
Now the same is being evaluated by one of the application security teams, they use burpsuite to intercept the request payload and have raised few security vulnerabilities which aren't reproducible without using Burpsuite.
So using such tools is still a valid case and considered to be vulnerable?
Let me explain test case which i am trying to find a solution, to avoid replay attack i use client and server nonce in my web application. Requests are intercepted using burp-suite and only the client nonce is changed and forwarded to the server and its obvious request will be processed. It is raised to be a vulnerability.