Your first probe

Probing is asking the server direct questions and writing down the answers. One request per path, then read: the status tells you whether it exists and whether you may see it, the headers tell you how carefully it is configured. You change nothing, which is what keeps this a review and not an attack.

The probing loop

Work every target the same way: request (method + path, exactly), response (status, Location, security headers), meaning (exists? guarded? misconfigured?), next (follow up or close the lead). Four lines per path in your notes. Triagers can reconstruct your whole test from that record — and in bounty work, the record is what gets paid.

A typical first pass over a shop looks like this:

GET /               → 200, no security headers   → note, not a finding yet
GET /login          → 200 with login form        → baseline for auth tests
GET /admin          → 302 to /login              → behaving; try side doors later
GET /old-backup.zip → 404                        → lead closed, move on

What counts as a finding here

Almost nothing on a first probe is a finding yet — and saying so is the skill. A 200 with no security headers is a note. A 404 is a closed lead. A redirect to login is correct behavior. The probe's product is the map, not the vulnerability: which paths exist, which are guarded, which deserve the injection and logic tests from the library tracks.

In this lab

Map four paths on https://shop.test. Read statuses and headers, record each in the four-line format, and answer the flag from your own notes. Change nothing; the server notices politeness.

Key takeaways

• Probe in a loop: request, response, meaning, next — four lines per path.
• Most first-pass results are notes or closed leads. The map is the deliverable.
• Guarded paths (302/403) become authorization targets; 200s with input become injection targets.