HTTP in depth: methods, headers, bodies
You write and read HTTP messages by hand with curl and netcat and see how methods, headers and body formats really work.
Level 201 · 18 lessons · 15 practice labs
Lessons
The message
- An HTTP message line by line
- Sending a request by hand with netcat
- Seeing with curl -v, -I and --trace
- Method semantics: safe and idempotent
- Status code families and choosing the right one
- Short task: download a page with netcat only
Headers and bodies
- Request headers: Host, User-Agent, Accept
- Content negotiation: Accept and Content-Type
- Form bodies: urlencoded and multipart
- Sending and receiving JSON bodies
- Compression: gzip, br and Content-Encoding
- Chunked transfer and range requests
- Short task: upload a file with curl and verify it
State and security headers
- Cookie attributes: Secure, HttpOnly, SameSite
- The Authorization header: Basic and Bearer
- Security headers: HSTS, CSP, X-Content-Type-Options
- Reading CORS headers
- Capstone: report on a site’s HTTP behaviour
Practice labs
- Request a page with netcat: Type a GET request by hand to the lab server with nc and separate the status line and headers of the reply.
- Reach the right site with the Host header: Three sites share one IP; change the Host header in a hand-written request to fetch each home page.
- Fix a malformed request: A hand-crafted request gets 400; find and fix the line endings, header format and version line errors.
- Choose the right method: Show by trying it which method the notes service expects for reading, adding, updating and deleting.
- Correct the wrong status codes: The sample server returns 200 for every error; review five cases and set the correct code for each.
- Measure the effect of a repeated request: Send the same request twice each with PUT, POST and DELETE and prove from the records which are safe and which idempotent.
- Send a record as a JSON body: Send a product record with curl using the right Content-Type and read the ID in the server's reply.
- Upload a file as a multipart form: Upload an invoice PDF and its description as multipart/form-data and verify it with the hash on the server.
- Resume a broken download: Download the rest of a large interrupted log file with a Range header and check the joined file's integrity.
- Ask for a compressed response: Request gzip and br with Accept-Encoding, compare the returned sizes and note which encoding was used.
- Get JSON and HTML from one URL: The product URL answers differently by Accept header; fetch both formats and find the case that returns 406.
- Decode a garbled Turkish response: Turkish characters in a reply are garbled; check charset, Content-Encoding and the body to find whether server or client is at fault.
- Audit cookie flags: Check the session cookie's Secure, HttpOnly and SameSite flags and list the missing ones.
- Use Basic and Bearer authorisation: Get a token from the reporting service with Basic auth, then download the protected report with a Bearer header.
- Grade a site's HTTP behaviour: Review HSTS, CSP, CORS and cookie headers on Lodos Energy's site and report the gaps in order of importance.
About this course
You write and read HTTP messages by hand with curl and netcat and see how methods, headers and body formats really work.
What you will learn
- The message
- Headers and bodies
- State and security headers
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.