HTTP Basics for CTF

Understand requests, responses, methods, headers, and cookies — the foundation of every web challenge.

Why HTTP matters

Every web challenge is a conversation over HTTP. Before you can exploit an application you need to read that conversation fluently: what the browser sends, what the server answers, and where the interesting state lives.

Anatomy of a request

POST /login HTTP/1.1
Host: target.ctf
Content-Type: application/x-www-form-urlencoded
Cookie: session=abc123

username=admin&password=letmein

Method — GET reads, POST submits, but CTFs love PUT, DELETE, and even made-up methods.
Headers — carry auth tokens, content types, and often the vulnerability (X-Forwarded-For, Referer, custom debug headers).
Cookies — where session state lives. Tampering with them is a classic first move.

Reading responses

Watch the status code (200, 302, 403, 500) and the response headers. A Set-Cookie, a leaked Server banner, or a verbose 500 stack trace is often the crack you pry open.

Practice

Fire up Burp Suite, browse the target, and read every request in the proxy history. You cannot exploit what you have not observed.