Visual Learning · 03 · Live
HTTP Request & Response
GET /index.html out; 200 OK + HTML back — request/response on the wire.
CYNARKS|Cyber Flow Explorer
Teaching simulation · not live capture
HTTP Request & Response
Lab origin only.
Real world · APIs and websites speak HTTP: method + path + headers out; status + headers + body back — the language of every browser.
Attack · Tampered headers or smuggled requests abuse HTTP parsing (covered in web-security modules).
Defense · Strict parsers, Host validation, and HTTPS-only reduce request abuse.
- Control · Validate Host and method allow-lists
- Control · Never trust client-supplied Content-Length alone in proxies
- Control · Prefer HTTP/2+ with modern stacks; keep cleartext HTTP off production
1. GET
Browser
userGET
GET /index.html
Web App
originBrowser sends GET with Host and Accept headers.
GET /index.html
- #1 client → server GET GET /index.html
Space · ← → · R restart