Core Technical Skills
How HTTP Really Works
Requests, responses, methods, headers, cookies — the language of web hacking.
Web hacking is just sending crafted HTTP requests and reading the responses. Once you can read a raw request/response, the whole web becomes editable.
GET /profile?id=3 HTTP/1.1
Host: shop.example.com
Cookie: session=abc123
User-Agent: Mozilla/5.0
Every part of that request is attacker-controlled: the path, the query parameter id=3, the cookie, and every header. The server trusting any of it blindly is where vulnerabilities begin.
Key pieces to know
- Methods: GET (fetch), POST (submit), PUT/DELETE (modify). Some APIs forget to restrict these.
- Status codes: 200 OK, 302 redirect, 403 forbidden, 500 server error (errors leak clues).
- Headers: Cookie, Authorization, Content-Type — auth and parsing decisions live here.
- Parameters: the values you control — and thus the values you attack (id=3 → id=4?).