Skip to content

Index

HTTP in one minute

A request has a method (GET, POST, PUT, PATCH, DELETE), a path, headers, and sometimes a body. A response has a status code, headers, and a body.

  • GET asks for data; parameters usually live in the query string.
  • POST sends data, usually in a JSON or form body.
  • PUT and PATCH update data.
  • Content-Type: application/json tells the server to parse the body as JSON.
  • A cookie is just a header. The browser sends it automatically; curl does not unless you ask it to.

Common status codes:

Code Meaning
200 OK
201 Created
301, 302, 303 Redirect
400 Bad request or malformed input
401 Not authenticated: missing or invalid session
403 Authenticated, but not allowed
404 Not found, or deliberately hidden
405 Method not allowed on this path
409 Conflict, such as a duplicate account
422 Validation failed: the JSON shape or types are wrong
500 Server error: read the response and the app logs

curl survival kit

# Headers and body
curl -i "http://<TARGET_IP>/"

# Quiet, but still show errors
curl -sS "http://<TARGET_IP>/health"

# Log in and save the session cookie
curl -sS -c /tmp/cookies.txt \
  -H 'Content-Type: application/json' \
  -d '{"identifier":"YOUR_USER","password":"YOUR_PASSWORD"}' \
  "http://<TARGET_IP>/api/auth/login"

# Send the saved cookie
curl -sS -b /tmp/cookies.txt "http://<TARGET_IP>/api/me"

# JSON POST
curl -sS -b /tmp/cookies.txt \
  -H 'Content-Type: application/json' \
  -d '{"q":"maya.chen"}' \
  "http://<TARGET_IP>/api/directory/search"

# URL-encode a query parameter
curl -sS -G --data-urlencode 'name=some file.txt' \
  "http://<TARGET_IP>/api/files/download"

# Send a body from a file, preserving newlines
curl -sS --data-binary @/tmp/body.json \
  -H 'Content-Type: application/json' \
  "http://<TARGET_IP>/api/admin/templates/preview"

-d sends a body and defaults to form encoding; the Content-Type header overrides that. --data-binary is safer for JSON that contains newlines. -G turns the data into a query string. If you are unsure of a request, right-click it in DevTools and choose Copy as cURL.

Shell quoting matters:

  • Single quotes preserve everything literally. Use them for JSON.
  • Double quotes expand $variables. Use them when you need expansion.
  • If a JSON body contains a single quote, put the body in a file and use --data-binary @file.

Browser DevTools

  • Network → Fetch/XHR, enable Preserve log, disable the cache.
  • Click a request and read Headers, Payload, Response, and Cookies.
  • Application → Cookies shows the session cookie and its flags.
  • Sources shows the JavaScript that builds the requests.
  • The console is useful for reading values, but the Network tab is the source of truth.