Why request analysis matters more than payload memorization

What I worked on

I spent time working through web and API security labs with Burp Suite, focusing on how requests change when authentication state, parameters, and object identifiers change.

What I learned

The useful skill is not memorizing a payload. It is recognizing where an application makes a security decision and testing whether that decision survives an unexpected request.

What confused me

It is easy to focus on the browser because that is what the user sees. The security boundary is usually deeper in the application and API.

What clicked

A normal request is evidence. Once I understand the expected flow, deviations become much easier to reason about.

What I’m exploring next

I am continuing to build a repeatable web/API assessment workflow and improve how I turn technical observations into concise security reports.