Tools · CTF categories for beginners · 19 / 26
Beginner web challenges: the status line is not the body
On a practice web challenge, the status line is the code the server sent. The body and the headers are other parts of the same response. Write all three, and do not decide the page is empty or solved from the code alone.
The status line is one field
A saved response starts with a status such as 200 or 404. That code is how the server labeled this response. It does not list the words in the body, and it does not say whether a comment, a header, or a script is worth reading.
A 200 can be a short template with nothing else in it. A 404 can still carry a body the author wrote. The code and the body are both part of what you were given.
Headers and body are separate
Response headers sit above the body. A header can name a content type or a cookie. The body is the document. If your note says “the page says,” point at the body. If it says “the server returned,” point at the status. Do not use one sentence for both.
This is practice on a challenge host or a local app the rules allow. You are reading a response you already saved. You are not changing the request into something the rules did not permit.
What to write down
File the URL, the status code, the header names you care about, and a short quote from the body. If the body is empty, write “body empty.” If you did not save the headers, write “headers not saved.”
Lab: a 404 with a practice sentence
A local practice app returns status 404 for /lab-room. The body is one sentence: “The practice room has no page at this path.” A draft says the path is useless because of the 404, and also says the flag must be the word room.
The note quotes 404 and the sentence. The code did not make the body disappear. The sentence is not in the event’s flag format, so it is not submitted. The path stays a saved response, not a solved challenge.
url: http://127.0.0.1:3000/lab-room status: 404 body: The practice room has no page at this path. flag format on the event sheet: not matched write: status and body not: empty, and not a flag
Diagram
The status line and the rest of the response
The code labels the response. It does not replace the body.
Is. The code the server sent
404. This response was labeled not found
Does not. Erase the body or name a flag
Are. The other parts you saved
A sentence in the body. Text to quote, still not a flag by itself
Missing. Say which part you did not save
Check yourself
1. A practice response is status 404 and the body has one sentence. What is the 404?
2. When may you call a sentence from the body a flag?
3. You saved the body and not the headers. What do you write?