Learn
LoginRegister
FundamentalsBeginnerFree lab

Fundamentals · browser room

HTTP Request & Response

Beginner65 ptsHTTP

Objective

See GET/headers go to the app and a 200 HTML response return.

Cyber Flow Explorer · 3 steps · Network / Sequence / Packet / Code.

Isolated browser lab. Practice here first — no live targets. Optional deeper practice lives in the Academy library after you finish this room.

Answer panel

Challenge workspace

Complete the room tasks, then submit here to mark the room done.

CYNARKS

Teaching simulation · not live capture

HTTP Request & Response

Lab origin only.

Real world · APIs and websites speak HTTP: method + path + headers out; status + headers + body back — the language of every browser.

Attack · Tampered headers or smuggled requests abuse HTTP parsing (covered in web-security modules).

Defense · Strict parsers, Host validation, and HTTPS-only reduce request abuse.

  • Control · Validate Host and method allow-lists
  • Control · Never trust client-supplied Content-Length alone in proxies
  • Control · Prefer HTTP/2+ with modern stacks; keep cleartext HTTP off production

1. GET

Browser

user
GET

GET /index.html

Web App

origin
Browser sends GET with Host and Accept headers.

GET /index.html

  • #1 client → server GET GET /index.html

Space · ← → · R restart

Hint

2xx = success class.

Why this is correct

Request line + headers out; status + headers + body back.