Learn / Networking Fundamentals / Names and Services

Talking to a Web Server

guidedeasy 30 min · 90 points

First Bit is still up for grabs: be the first to finish this room.

Every time you open a web page, your browser and a web server have a short, very structured conversation called HTTP. Browsers hide it, but you can have that conversation yourself from a terminal, and seeing the raw requests and responses is the foundation of web development, troubleshooting and web security alike.

CYB//RANGE Live lab

Task 1 Requests and responses

An HTTP exchange is a request from the client and a response from the server.

A request names a method and a path, followed by headers:

GET /about HTTP/1.1
Host: www.corp.lab
User-Agent: curl/8.14

GET fetches something. POST sends data, as when you submit a form. HEAD asks for just the headers, without the page itself.

The response starts with a status code, then headers, then (usually) the body:

HTTP/1.1 200 OK
Content-Type: text/html
Server: nginx

<h1>About</h1>...

The first digit of the status code tells you the family:

Code	Family	Common examples
2xx	success	200 OK
3xx	redirect: go somewhere else	301 Moved Permanently, 302 Found
4xx	client error: your request was the problem	403 Forbidden, 404 Not Found
5xx	server error: the server failed	500 Internal Server Error, 502 Bad Gateway

Headers carry extra information in both directions: content type, cookies, caching rules, and sometimes things the server didn't mean to reveal.

Which HTTP method does a browser use to fetch a page?

***

Which status code means "Not Found"?

***

Status codes starting with which digit mean "go somewhere else" (redirects)?

*

Task 2 HTTP by hand with curl

curl makes HTTP requests from the command line and prints the body of the response:

$ curl http://localhost:8080/about
<h1>About</h1>...

The options you'll use constantly:

Option	Does
`-I`	send a HEAD request: show only the response headers
`-i`	show the headers and the body
`-L`	follow redirects to wherever they point
`-v`	verbose: show the request curl sends and everything it receives
`-s`	silent: no progress bar

When a page returns a redirect, curl on its own just shows you the 3xx response and its Location: header. -L follows it. -I is the fastest way to see a status code and the server's headers without downloading the page.

Which curl option fetches only the response headers? (Short or long form.)

**

Which curl option makes it follow redirects? (Short or long form.)

**

Task 3 Try it on a real machine

The lab machine runs a small company web server on port 8080.

Press Launch in CybRange at the top of this page, then Open terminal next to box once it's ready. You're logged in as kai.
Fetch the home page, curl http://localhost:8080/, then look at its headers with curl -I.
Try /about, /status, /admin, /old-page and a page that doesn't exist. Note each status code, then follow the redirect with -L.

What name does the web server give itself in its Server: header (the part before the slash)?

********

What status code does /admin return?

***

/old-page redirects. Which path does it send you to?

/*****

The home page sends one unusual header along with the page. What value does it hold?

RZ{************************}