Unit 1: Requests and responses · Lesson 1 of 5 · 18 min
The conversation
A browser and a server talk in plain text. curl shows you both sides.
mission
- You are
- A new analyst on the security team at Example Shop.
- Situation
- The shop app runs on your lab machine. Before anyone reviews it, the team wants you to show exactly what one request and one response look like.
- Goal
- Capture one full exchange with curl and label every part of it.
- Hand in
- The request head, the response head and one sentence on what each line means.
One exchange
Ask for the health page
Start with the smallest page the app has. curl prints only the body by default.
curl -s http://127.0.0.1:8000/health
ok
you should see Just ok. Everything else in the exchange is hidden.
Show both sides
With -v, curl marks what it sends with > and what it receives with <. It writes these to standard error, so 2>&1 sends them into the pipe.
curl -sv http://127.0.0.1:8000/health 2>&1 | grep '^[<>]'
> GET /health HTTP/1.1
> Host: 127.0.0.1:8000
> User-Agent: curl/8.5.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: shop/1.4
< Date: Wed, 14 Oct 2026 09:00:00 GMT
< Content-Type: text/plain; charset=utf-8
< Content-Length: 3
<
you should see A request line, three request headers, then a status line and four response headers. The lone > and < lines are the blank lines that end each head.
defender tip Save -v output when you report a finding. It proves exactly what you sent and what came back.
Read the response the way a parser does
-i prints the response head above the body, which is what most review notes quote.
curl -si http://127.0.0.1:8000/health
HTTP/1.1 200 OK
Server: shop/1.4
Date: Wed, 14 Oct 2026 09:00:00 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 3
ok
you should see Content-Length: 3, matching ok plus a newline.
Check the length yourself
curl -s http://127.0.0.1:8000/health | wc -c
3
you should see 3 bytes, the same number the server announced.
defender tip When Content-Length and the real body disagree, proxies and servers can read the stream differently. That mismatch is the root of request smuggling bugs.
Request head and response head
GET /health HTTP/1.1 Host: 127.0.0.1:8000 User-Agent: curl/8.5.0 Accept: */*
Method, path and version first, then headers.
HTTP/1.1 200 OK Server: shop/1.4 Date: Wed, 14 Oct 2026 09:00:00 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 3
Version, status code and reason first, then headers.
What a defender takes away
- 1HTTP is plain text: a first line, headers, a blank line and an optional body.
- 2
curl -vshows the request you sent and the response you got. - 3The Server header tells everyone which product and version you run.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.