First contact
You've just been handed the target at http://127.0.0.1:8080 and nothing else. Make first contact: pull its landing page, save it, and find out which API path it advertises.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
Recon always starts this quietly: one request to the front page, read every word of what comes back, and note every link and endpoint it hands you. You saved the page so you can grep it offline instead of hammering the server, and you found /api/ping — the endpoint you'll attack later.
Show solution
cd /home/student
curl -s http://127.0.0.1:8080/ -o landing.html
grep -o '/api/ping' landing.html