Reference: https://shahmeeramir.com/penetration-testing-of-an-ftp-server-19afe538be4b

ROE stands for Rules of Engagement, which are the guidelines and limitations that define the scope, objectives, and methods of a penetration testing engagement. ROE should be agreed upon by both the client and the tester before the testing begins, and they should include the authorization to perform certain actions, such as requesting CVE numbers, disclosing vulnerabilities, or exploiting systems. By requesting a CVE number without express authorization, the penetration tester most likely breached the ROE and violated the client's trust and expectations. References:
*The Official CompTIA PenTest+ Study Guide (Exam PT0-002), Chapter 1: Planning and Scoping Penetration Tests, page 23-24.
*CVE - CVE1
*NDA, MSA, SOW and SLA. Confidentiality agreements when you outsource QA

The element /about is most likely to contain useful information for the penetration tester, as it may reveal details about the website's owner, purpose, history, contact information, etc. This information can be used for further reconnaissance, social engineering, or identifying potential vulnerabilities.

Burp Suite is a tool that allows intercepting and modifying HTTP requests and responses of an API, as well as performing other web application security testing tasks. Burp Suite can act as a proxy between the mobile device and the API server, and enable the tester to view, edit, and replay the HTTP traffic. Burp Suite can also modify the content of the HTTP response, such as changing the status code, headers, or body, and forward it back to the mobile device12. The other tools are not suitable for this purpose, as they either focus on Android application analysis and exploitation (Drozer and MobSF) or development and debugging (Android SDK Tools). References:
*Intercepting Mobile Application Traffic Using Burp Suite, Infosec Resources article by Srinivas
*How to Intercept and Modify HTTP Requests and Responses with Burp Suite, MDN Web Docs article by Mozilla