Talking HTTP with curl

Requests and responses

Every web interaction is a request you send and a response the server sends back. The response starts with a status line and headers, then a blank line, then the body. Add -i to make curl show the headers too:

curl -i http://127.0.0.1:8080/

In the terminal

student@vulntech:~$ curl -i http://127.0.0.1:8080/
HTTP/1.1 200 OK
Server: Werkzeug/2.2.2 Python/3.11.2
Date: Sun, 18 Oct 2026 12:28:29 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 700
Connection: close

<!doctype html>
<title>VulnTech Target</title>
<h1>VulnTech Practice Target</h1>
<p>This machine hosts the deliberately-vulnerable apps for the Web Pentesting
labs. Everything here runs only inside your browser VM on 127.0.0.1.</p>
<ul>
  <li><a href="/api/ping?host=127.0.0.1">/api/ping?host=...</a> &mdash; network tool</li>
  <li><a href="/app/search?q=hello">/app/search?q=...</a> &mdash; search the site</li>
  <li><a href="/app/login">/app/login</a> &mdash; member login (POST username, password)</li>
  <li><a href="/app/note?id=2">/app/note?id=...</a> &mdash; read a saved note</li>
  <li><a href="/app/download?file=welcome.txt">/app/download?file=...</a> &mdash; download a file</li>
</ul>

The first line is the status: 200 OK means success. The Server: and Content-Type: headers are already leaking useful facts about the stack — more on that next module.

Often you only care about the status code. These flags print just the number: -o /dev/null throws the body away and -w '%{http_code}' prints the code:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8080/
curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8080/does-not-exist

In the terminal

student@vulntech:~$ curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8080/
200
student@vulntech:~$ curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8080/does-not-exist
404

A real page answers 200; a path that doesn't exist answers 404. That difference is how you map an app you were given no documentation for.