HTTP & HTTPS: How the Web Talks

Every time you open a web page, your browser and a web server hold a short conversation. HTTP is the language they speak. Learn to read and write it, and most of web hacking suddenly makes sense, because almost every web attack is just an unusual HTTP request.

What is HTTP?

HTTP stands for HyperText Transfer Protocol. It is the agreed set of rules browsers and servers use to move web content, HTML pages, images, videos, files, back and forth. It was created around 1989 to 1991 by Tim Berners-Lee and his team at CERN, and it is plain text, so a human can read a request or response directly.

What is HTTPS?

HTTPS (the S is for Secure) is HTTP wrapped in encryption (TLS, from the TLS lesson). It adds two guarantees:

Privacy , anyone sniffing the network sees only scrambled ciphertext, not your data.
Identity , the server proves who it is with a certificate, so you know you aren't talking to an impostor.

That is the padlock in your address bar. Always prefer HTTPS, and never send passwords over plain HTTP.

Anatomy of a URL

A URL (Uniform Resource Locator) is the address that tells the browser where and how to fetch something. A full one has several parts, though most requests use only a few:

https://admin:pass@hackingpath.com:443/view-lesson?id=1#section2

scheme

user info

host

port

path

query

fragment

Most requests use only a few of these. The scheme, host and path are the essentials.

Scheme , the protocol to use: https, http, ftp.
User info , an optional user:password@ for sites that need a login in the URL.
Host , the domain name (or IP) of the server, hackingpath.com.
Port , which port to connect to (default 80 for HTTP, 443 for HTTPS). Any port 1 to 65535 is possible.
Path , which resource on the server, /view-lesson.
Query , extra input after a ?, ?id=1 asks for the item with id 1.
Fragment , a #section2 jump to a spot on the page (handled by the browser, not sent to the server).

A request and a response

To load a page the browser sends a request; the server sends back a response.

An example request:

GET /lessons HTTP/1.1
Host: hackingpath.com
User-Agent: Mozilla/5.0 (HackingPath)
Accept: text/html

Line 1 is the request line: the method (GET), the path (/lessons), and the version (HTTP/1.1).
The next lines are headers, extra information for the server (which site, which browser, what it accepts).
A blank line marks the end of the request.

An example response:

HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html
Content-Length: 137

<html><body>Welcome to Hacking Path</body></html>

Line 1 is the status line: the version and a status code (200 OK = success).
Content-Type tells the browser what kind of data follows (HTML here); Content-Length says how many bytes to expect.
After the blank line comes the body, the actual content you asked for.

A real example, curl against a live site

You don't need a browser to see this in action, curl prints the raw response of any site. Try it on this very page:

$ curl "https://hackingpath.com/"
<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"/>
<meta name="viewport" content="width=device-width, initial-scale=1"/>
<link rel="stylesheet" href="/assets/styles-XXXXXXXX.css"/>
<title>Hacking Path: Learn ethical hacking, from zero.</title>
...

That wall of HTML is exactly what your browser receives before it renders anything, curl just skips the rendering step and shows you the raw material. Run curl -I https://hackingpath.com/ instead and you get only the response headers, no body, a fast way to check what server and technology a site is running.

Methods, the verb of the request

The method says what you intend to do. You will mostly meet four:

Method	Meaning	Example
GET	Read / fetch something	Open a page
POST	Create a new record	Sign up a user
PUT	Update an existing record	Change your email
DELETE	Remove a record	Delete a photo

Status codes, the outcome

The first digit of the code tells you the category:

Range	Category	Meaning
1xx	Informational	Keep going (rare)
2xx	Success	It worked
3xx	Redirect	Look somewhere else
4xx	Client error	You got it wrong
5xx	Server error	The server broke

The ones you will see most:

200 OK , success. 201 Created , a new record was made.
301/302 , moved (permanent / temporary redirect).
400 Bad Request , something was wrong or missing in your request.
401 Unauthorized , log in first. 403 Forbidden , you're logged in but still not allowed.
404 Not Found , no such page. 405 Method Not Allowed , wrong method for this route.
500 Internal Server Error , the server crashed. 503 Service Unavailable , overloaded or down for maintenance.

Headers, the extra details

Headers carry information alongside the request or response. A few worth knowing:

Request , Host (which site, when one server hosts many), User-Agent (your browser), Content-Length (size of the data you're sending), Cookie (see below).
Response , Set-Cookie (store this cookie), Content-Type (what kind of data), Content-Length (how big), Cache-Control (how long to cache).

Cookies, how the web remembers you

HTTP is stateless: each request stands alone, the server forgets you the instant it replies. So how do sites keep you logged in? Cookies. The server sends a Set-Cookie header once; your browser stores it and automatically attaches it (as a Cookie header) on every later request, so the server recognises you again.

The cookie value is usually a random session token (not your password in plain text). You can watch cookies fly back and forth in your browser's developer tools, under the Network tab.

Try it, the HTTP Lab

Use the HTTP Lab beside you. Build requests and capture all five flags:

Send a GET to /room.
GET /blog with the query parameter id = 1.
Send a DELETE to /user/1.
PUT to /user/2 with the parameter username = admin.
POST to /login with username = hp and password = letmein.

Watch what happens when you get it slightly wrong: a wrong method returns 405, a missing parameter returns 400, and bad credentials return 401. That feedback is the lesson.

Why this matters

Web hacking is the art of sending requests a site did not expect, a method it didn't plan for, a parameter it didn't validate, a cookie it trusted too much. Once you can read and write HTTP fluently, tools like Burp Suite and curl become extensions of your hands.

HTTP & HTTPS: How the Web Talks

What is HTTP?

What is HTTPS?

HTTPS (the S is for Secure) is HTTP wrapped in encryption (TLS, from the TLS lesson). It adds two guarantees:

Privacy , anyone sniffing the network sees only scrambled ciphertext, not your data.
Identity , the server proves who it is with a certificate, so you know you aren't talking to an impostor.

That is the padlock in your address bar. Always prefer HTTPS, and never send passwords over plain HTTP.

Anatomy of a URL

A URL (Uniform Resource Locator) is the address that tells the browser where and how to fetch something. A full one has several parts, though most requests use only a few:

https://admin:pass@hackingpath.com:443/view-lesson?id=1#section2

scheme

user info

host

port

path

query

fragment

Most requests use only a few of these. The scheme, host and path are the essentials.

Scheme , the protocol to use: https, http, ftp.
User info , an optional user:password@ for sites that need a login in the URL.
Host , the domain name (or IP) of the server, hackingpath.com.
Port , which port to connect to (default 80 for HTTP, 443 for HTTPS). Any port 1 to 65535 is possible.
Path , which resource on the server, /view-lesson.
Query , extra input after a ?, ?id=1 asks for the item with id 1.
Fragment , a #section2 jump to a spot on the page (handled by the browser, not sent to the server).

A request and a response

To load a page the browser sends a request; the server sends back a response.

An example request:

GET /lessons HTTP/1.1
Host: hackingpath.com
User-Agent: Mozilla/5.0 (HackingPath)
Accept: text/html

Line 1 is the request line: the method (GET), the path (/lessons), and the version (HTTP/1.1).
The next lines are headers, extra information for the server (which site, which browser, what it accepts).
A blank line marks the end of the request.

An example response:

HTTP/1.1 200 OK
Server: nginx
Content-Type: text/html
Content-Length: 137

<html><body>Welcome to Hacking Path</body></html>

Line 1 is the status line: the version and a status code (200 OK = success).
Content-Type tells the browser what kind of data follows (HTML here); Content-Length says how many bytes to expect.
After the blank line comes the body, the actual content you asked for.

A real example, curl against a live site

You don't need a browser to see this in action, curl prints the raw response of any site. Try it on this very page:

$ curl "https://hackingpath.com/"
<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"/>
<meta name="viewport" content="width=device-width, initial-scale=1"/>
<link rel="stylesheet" href="/assets/styles-XXXXXXXX.css"/>
<title>Hacking Path: Learn ethical hacking, from zero.</title>
...

Methods, the verb of the request

The method says what you intend to do. You will mostly meet four:

Method	Meaning	Example
GET	Read / fetch something	Open a page
POST	Create a new record	Sign up a user
PUT	Update an existing record	Change your email
DELETE	Remove a record	Delete a photo

Status codes, the outcome

The first digit of the code tells you the category:

Range	Category	Meaning
1xx	Informational	Keep going (rare)
2xx	Success	It worked
3xx	Redirect	Look somewhere else
4xx	Client error	You got it wrong
5xx	Server error	The server broke

The ones you will see most:

200 OK , success. 201 Created , a new record was made.
301/302 , moved (permanent / temporary redirect).
400 Bad Request , something was wrong or missing in your request.
401 Unauthorized , log in first. 403 Forbidden , you're logged in but still not allowed.
404 Not Found , no such page. 405 Method Not Allowed , wrong method for this route.
500 Internal Server Error , the server crashed. 503 Service Unavailable , overloaded or down for maintenance.

Headers, the extra details

Headers carry information alongside the request or response. A few worth knowing:

Request , Host (which site, when one server hosts many), User-Agent (your browser), Content-Length (size of the data you're sending), Cookie (see below).
Response , Set-Cookie (store this cookie), Content-Type (what kind of data), Content-Length (how big), Cache-Control (how long to cache).

Cookies, how the web remembers you

The cookie value is usually a random session token (not your password in plain text). You can watch cookies fly back and forth in your browser's developer tools, under the Network tab.

Try it, the HTTP Lab

Use the HTTP Lab beside you. Build requests and capture all five flags:

Send a GET to /room.
GET /blog with the query parameter id = 1.
Send a DELETE to /user/1.
PUT to /user/2 with the parameter username = admin.
POST to /login with username = hp and password = letmein.

Watch what happens when you get it slightly wrong: a wrong method returns 405, a missing parameter returns 400, and bad credentials return 401. That feedback is the lesson.

HTTP & HTTPS: How the Web Talks

What you'll learn

HTTP & HTTPS: How the Web Talks

What is HTTP?

What is HTTPS?

Anatomy of a URL

A request and a response

A real example, curl against a live site

Methods, the verb of the request

Status codes, the outcome

Headers, the extra details

Cookies, how the web remembers you

Try it, the HTTP Lab

Why this matters

Check your understanding

What you'll learn

HTTP & HTTPS: How the Web Talks

What is HTTP?

What is HTTPS?

Anatomy of a URL

A request and a response

A real example, curl against a live site

Methods, the verb of the request

Status codes, the outcome

Headers, the extra details

Cookies, how the web remembers you

Try it, the HTTP Lab

Why this matters

Check your understanding