Unit 7: The network from the host · Lesson 3 of 7 · 18 min

Talking to a local service

Use curl to read a status API's headers, health and a debug page that should not exist.

mission

You are
You are reviewing the shop's internal status API on port 8081.
Situation
It only listens on 127.0.0.1, so the team calls it internal. Anything on the machine can still reach it, including a compromised web process.
Goal
Query each endpoint and decide what it exposes.
Hand in
The service version and any endpoint that leaks secrets.
01

Ask what it is

learner@root-lab
curl -s localhost:8081/
{"service": "shop-status", "version": "1.4.2", "status": "ok"}
curl -si localhost:8081/ | head -n 2
HTTP/1.0 200 OK
Server: shop-status/1.4.2

you should see -s hides the progress bar, -i includes headers. The Server header gives the version away too.

02

Probe the likely endpoints

learner@root-lab
for p in / /health /debug /admin /status; do printf '%s %s\n' $(curl -s -o /dev/null -w '%{http_code}' localhost:8081$p) $p; done
200 /
200 /health
200 /debug
404 /admin
404 /status

you should see Three endpoints answer. -w '%{http_code}' prints only the status code.

03

Read the debug page

learner@root-lab
curl -s localhost:8081/debug
{"config": {"app_env": "production", "db_host": "10.20.0.12", "db_user": "shop_app", "db_password": "lab-only-not-a-real-secret", "debug": true}}

you should see The full config with the database password, in production.

defender tip Local-only is not a security boundary. Remove debug routes from production builds instead.

What a defender takes away

  1. 1curl -s and -i are your first look at any HTTP service.
  2. 2Loop over likely paths and read the status codes.
  3. 3Debug endpoints in production leak secrets.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.

  1. Show hint

    curl -s localhost:8081/

  2. Show hint

    Try each endpoint.

  3. Show hint

    curl -w '%{http_code}'