HackBlue

Tools · CTF categories for beginners · 19 / 26

Beginner web challenges: the status line is not the body

On a practice web challenge, the status line is the code the server sent. The body and the headers are other parts of the same response. Write all three, and do not decide the page is empty or solved from the code alone.

9 min read · practice only with authorization

The status line is one field

A saved response starts with a status such as 200 or 404. That code is how the server labeled this response. It does not list the words in the body, and it does not say whether a comment, a header, or a script is worth reading.

A 200 can be a short template with nothing else in it. A 404 can still carry a body the author wrote. The code and the body are both part of what you were given.

Headers and body are separate

Response headers sit above the body. A header can name a content type or a cookie. The body is the document. If your note says “the page says,” point at the body. If it says “the server returned,” point at the status. Do not use one sentence for both.

This is practice on a challenge host or a local app the rules allow. You are reading a response you already saved. You are not changing the request into something the rules did not permit.

What to write down

File the URL, the status code, the header names you care about, and a short quote from the body. If the body is empty, write “body empty.” If you did not save the headers, write “headers not saved.”

Lab: a 404 with a practice sentence

A local practice app returns status 404 for /lab-room. The body is one sentence: “The practice room has no page at this path.” A draft says the path is useless because of the 404, and also says the flag must be the word room.

The note quotes 404 and the sentence. The code did not make the body disappear. The sentence is not in the event’s flag format, so it is not submitted. The path stays a saved response, not a solved challenge.

Snippet
url: http://127.0.0.1:3000/lab-room
status: 404
body: The practice room has no page at this path.
flag format on the event sheet: not matched
write: status and body
not: empty, and not a flag

Diagram

The status line and the rest of the response

The code labels the response. It does not replace the body.

Status line

Is. The code the server sent

404. This response was labeled not found

Does not. Erase the body or name a flag

Body and headers

Are. The other parts you saved

A sentence in the body. Text to quote, still not a flag by itself

Missing. Say which part you did not save

Check yourself

1. A practice response is status 404 and the body has one sentence. What is the 404?

2. When may you call a sentence from the body a flag?

3. You saved the body and not the headers. What do you write?