kavklaw@llm $ cat http-reference.md
Status codes, methods, security headers, protocol versions, cookies — the complete HTTP reference for pentesters.
GET /path/to/resource HTTP/1.1 ← Request line (Method SP URI SP Version)
Host: target.com ← Required header
User-Agent: Mozilla/5.0 ... ← Client identifier
Accept: text/html, application/json ← Acceptable response types
Cookie: session=abc123 ← Session cookies
Authorization: Bearer eyJhbG... ← Auth token
Content-Type: application/json ← Body format (POST/PUT)
Content-Length: 42 ← Body size in bytes
← Empty line (CRLF)
{"key": "value"} ← Request body (optional)HTTP/1.1 200 OK ← Status line (Version SP Code SP Reason)
Date: Sun, 08 Feb 2026 19:00:00 GMT ← Server timestamp
Content-Type: text/html; charset=utf-8
Content-Length: 1234
Set-Cookie: session=xyz; HttpOnly; Secure; SameSite=Strict
Cache-Control: no-store
X-Frame-Options: DENY
← Empty line (CRLF)
<!DOCTYPE html>... ← Response bodyCode Name Notes
──────────────────────────────────────────────────────────────
100 Continue Client should continue sending body
101 Switching Protocols Upgrade to WebSocket/HTTP2
102 Processing (WebDAV) Server received, still processing
103 Early Hints Preload resources before final response
Security: 101 used in WebSocket hijacking. Watch for unexpected upgrades.Code Name Notes
──────────────────────────────────────────────────────────────
200 OK Standard success response
201 Created Resource created (POST/PUT)
202 Accepted Queued for processing (async)
203 Non-Authoritative Info Transformed by proxy
204 No Content Success but no body (DELETE)
205 Reset Content Clear the form/view
206 Partial Content Range request fulfilled
207 Multi-Status (WebDAV) Multiple status codes in body
208 Already Reported (WebDAV)
Security: 200 on login = valid creds (credential stuffing signal).
204 often used for CORS preflight responses.Code Name Notes
──────────────────────────────────────────────────────────────
300 Multiple Choices Multiple representations available
301 Moved Permanently Resource permanently at new URL
302 Found Temporary redirect (commonly misused)
303 See Other Redirect with GET after POST
304 Not Modified Cached version is current
305 Use Proxy (Deprecated) Must use specified proxy
307 Temporary Redirect Like 302 but preserves HTTP method
308 Permanent Redirect Like 301 but preserves HTTP method
Security: Open redirects (301/302/307) → phishing via trusted domain.
302 after login can leak tokens in Referer header.
Check Location header for user-controlled input.Code Name Notes
──────────────────────────────────────────────────────────────
400 Bad Request Malformed syntax / invalid input
401 Unauthorized Authentication required (no/bad creds)
402 Payment Required Reserved (rarely used)
403 Forbidden Authenticated but insufficient perms
404 Not Found Resource doesn't exist
405 Method Not Allowed HTTP method not supported for endpoint
406 Not Acceptable Server can't match Accept headers
407 Proxy Auth Required Proxy needs authentication
408 Request Timeout Client too slow to send request
409 Conflict State conflict (e.g., duplicate resource)
410 Gone Resource permanently removed
411 Length Required Content-Length header missing
412 Precondition Failed Conditional request failed (If-Match)
413 Payload Too Large Body exceeds server limit
414 URI Too Long URL exceeds server limit
415 Unsupported Media Type Content-Type not supported
416 Range Not Satisfiable Invalid byte range
417 Expectation Failed Expect header unsupported
418 I'm a Teapot Easter egg (RFC 2324)
421 Misdirected Request Wrong server for this request
422 Unprocessable Entity Syntactically valid but semantically wrong
423 Locked (WebDAV) Resource is locked
425 Too Early Replay risk on 0-RTT
426 Upgrade Required Must switch protocol (e.g., to TLS)
428 Precondition Required Server requires conditional request
429 Too Many Requests Rate limited — slow down
431 Request Header Too Large Headers exceed server limit
451 Unavailable for Legal Censored / legal block
Security Relevance:
401 vs 403 → Enumerate valid vs invalid users
404 vs 403 → Directory/file existence disclosure
405 → Discover allowed methods (try all verbs)
429 → Rate limiting indicator (adjust brute force)
431 → Header injection amplification
413 → File upload size limitsCode Name Notes
──────────────────────────────────────────────────────────────
500 Internal Server Error Unhandled exception — check for injection
501 Not Implemented Server doesn't support the method
502 Bad Gateway Upstream server sent invalid response
503 Service Unavailable Server overloaded or under maintenance
504 Gateway Timeout Upstream server didn't respond in time
505 HTTP Version Not Supported
507 Insufficient Storage (WebDAV)
508 Loop Detected (WebDAV) Infinite loop in operation
510 Not Extended Further extensions required
511 Network Auth Required Captive portal (e.g., hotel WiFi)
Security:
500 → May leak stack traces, file paths, DB errors
502 → Indicates proxy/reverse proxy (map architecture)
503 → DoS success indicator
504 → Timeout-based blind injection signalMethod Safe Idempotent Body Purpose
──────────────────────────────────────────────────────────────
GET ✓ ✓ No Retrieve resource
HEAD ✓ ✓ No GET without body (headers only)
POST ✗ ✗ Yes Create resource / submit data
PUT ✗ ✓ Yes Replace resource entirely
PATCH ✗ ✗ Yes Partial update
DELETE ✗ ✓ Maybe Remove resource
OPTIONS ✓ ✓ No List supported methods/CORS preflight
TRACE ✓ ✓ No Echo request back (debug)
CONNECT ✗ ✗ No Establish tunnel (HTTPS proxy)
Safe = No side effects on server
Idempotent = Same result if called multiple times
Security:
OPTIONS → Enumerate allowed methods
TRACE → Cross-Site Tracing (XST), reflects cookies
PUT → Arbitrary file upload if misconfigured
DELETE → Resource destruction if no auth
PATCH → Mass assignment vulnerabilities
# Test all methods on an endpoint
for m in GET POST PUT DELETE PATCH HEAD OPTIONS TRACE; do
echo "=== $m ===" && curl -s -o /dev/null -w "%{http_code}" -X $m https://target.com/api/resource
doneHeader Example Value Purpose
──────────────────────────────────────────────────────────────────────────────────────
Content-Security-Policy (CSP) default-src 'self'; script-src 'self' XSS prevention — controls resource loading
Strict-Transport-Security max-age=31536000; includeSubDomains Force HTTPS (HSTS) for specified duration
X-Frame-Options DENY | SAMEORIGIN Clickjacking prevention
X-Content-Type-Options nosniff Prevent MIME type sniffing
X-XSS-Protection 1; mode=block Legacy XSS filter (deprecated, use CSP)
Referrer-Policy no-referrer | strict-origin-when-cross-origin Control Referer header leakage
Permissions-Policy camera=(), microphone=(), geolocation=() Restrict browser features
Cache-Control no-store, no-cache, must-revalidate Prevent sensitive data caching
X-Permitted-Cross-Domain none Block Flash/PDF cross-domain
CSP Directives Cheat Sheet:
default-src Fallback for all resource types
script-src JavaScript sources
style-src CSS sources
img-src Image sources
connect-src XHR / fetch / WebSocket targets
font-src Font file sources
frame-src iframe sources
media-src Audio/video sources
object-src Plugin sources (Flash)
base-uri Restrict <base> tag
form-action Form submission targets
frame-ancestors Who can iframe this page (replaces X-Frame-Options)
report-uri Where to send violation reports
'self' Same origin
'none' Block all
'unsafe-inline' Allow inline (defeats CSP purpose)
'unsafe-eval' Allow eval() (dangerous)
'nonce-xxx' Allow specific inline scripts
'strict-dynamic' Trust scripts loaded by trusted scriptsPreflight Request (browser sends automatically):
OPTIONS /api/data HTTP/1.1
Origin: https://attacker.com
Access-Control-Request-Method: POST
Access-Control-Request-Headers: Content-Type, Authorization
Server Response:
Access-Control-Allow-Origin: https://trusted.com ← Who can access
Access-Control-Allow-Methods: GET, POST ← Allowed methods
Access-Control-Allow-Headers: Content-Type ← Allowed headers
Access-Control-Allow-Credentials: true ← Allow cookies
Access-Control-Max-Age: 86400 ← Cache preflight (sec)
Access-Control-Expose-Headers: X-Custom ← Headers JS can read
Dangerous Misconfigurations:
Access-Control-Allow-Origin: * ← Anyone can read responses
Access-Control-Allow-Origin: [reflected from Origin] ← Reflects attacker origin
Access-Control-Allow-Credentials: true + wildcard ← Browsers block this combo
# Test CORS
curl -H "Origin: https://evil.com" -I https://target.com/api/data
# Check if Access-Control-Allow-Origin reflects your originSet-Cookie: session=abc123; Path=/; Domain=.target.com; Expires=...; Max-Age=3600;
HttpOnly; Secure; SameSite=Strict
Attribute Purpose Security Impact
──────────────────────────────────────────────────────────────────────
HttpOnly Not accessible via JavaScript Mitigates XSS cookie theft
Secure Only sent over HTTPS Prevents cleartext interception
SameSite=Strict Not sent on cross-site requests Strongest CSRF protection
SameSite=Lax Sent on top-level navigations (GET) Default in modern browsers
SameSite=None Always sent (requires Secure flag) Needed for cross-site embeds
Domain Which domains receive the cookie Overly broad = risk
Path URL path scope / = all paths
Expires/Max-Age Cookie lifetime Persistent vs session
__Secure- Prefix: must have Secure flag Browser-enforced
__Host- Prefix: Secure + no Domain + Path=/ Strictest: can't be overridden
Cookie Attacks:
Session hijacking Steal cookie via XSS (if no HttpOnly)
Session fixation Force known session ID before login
CSRF Cookies auto-sent on cross-origin requests
Cookie tossing Set cookie from subdomain to override parent
Cookie jar overflow Fill cookie jar to evict legitimate cookiesFeature HTTP/1.1 HTTP/2 HTTP/3
──────────────────────────────────────────────────────────────────────
Year 1997 2015 2022
Transport TCP TCP QUIC (over UDP)
Multiplexing No (1 req/conn) Yes (streams) Yes (streams)
Header compression No HPACK QPACK
Server push No Yes Yes
Encryption Optional Practically TLS Always TLS 1.3
Head-of-line block Yes (TCP + HTTP) TCP-level only None (UDP)
Connection setup TCP + TLS (2-3 RTT) TCP + TLS (2 RTT) 0-1 RTT (QUIC)
Text/binary Text-based Binary framing Binary framing
Pipelining Possible (buggy) Replaced by mux Replaced by mux
Security Implications:
HTTP/2: Request smuggling via h2 → h1 downgrade at proxy
HTTP/2: HPACK compression oracle attacks (CRIME-like)
HTTP/2: Stream priority manipulation for DoS
HTTP/3: Amplification via UDP, harder to firewall
All: TLS version downgrade attacks# Inspect response headers
curl -I https://target.com
# Follow redirects and show all headers
curl -vL https://target.com 2>&1 | grep -E "^(<|>)"
# Send POST with JSON body
curl -X POST https://target.com/api/login \
-H "Content-Type: application/json" \
-d '{"user":"admin","pass":"admin"}'
# Test for open redirect
curl -s -o /dev/null -w "%{redirect_url}" "https://target.com/redirect?url=https://evil.com"
# Send cookie
curl -b "session=abc123" https://target.com/dashboard
# Test methods
curl -X OPTIONS -I https://target.com/
# Test CORS
curl -H "Origin: https://evil.com" -I https://target.com/api/
# Check security headers
curl -sI https://target.com | grep -iE "(strict|content-security|x-frame|x-content|referrer|permissions)"
# Upload file via PUT
curl -X PUT -d @shell.php https://target.com/uploads/shell.php
# HTTP/2 explicit
curl --http2 -I https://target.com
# Send with custom User-Agent
curl -A "Mozilla/5.0 (compatible; Googlebot/2.1)" https://target.com