Reading HTTP

Almost every web finding starts as a status code plus a header. Learn to read responses the way triagers do and half of web testing becomes pattern recognition.

Status codes that matter

200 means the server answered with content — but content for whom? A /admin that returns 200 to an unauthenticated stranger is a finding; the same 200 for a logged-in admin is normal. Always ask who you were when you got the answer.

301/302 mean go look over there. Where they point is often the finding: an admin panel that redirects strangers to /login is enforcing authentication correctly; one that redirects to itself in a loop is broken in an interesting way. Record the Location header, not just the code.

403 means the server understood and refused — the path exists and something guards it. 404 means the path is not there at all. The difference decides your next move: 403 invites authorization tests (different roles, methods, headers), 404 closes the lead.

500 means your input broke something server-side. Note the exact payload that caused it — error-based discovery starts here — but never hammer it: one confirming request, then write it down.

Security headers

Headers carry the security posture. Strict-Transport-Security pins HTTPS so network attackers cannot downgrade it. Content-Security-Policy constrains which scripts may run, blunting XSS. X-Frame-Options / frame-ancestors block clickjacking. Set-Cookie flags (Secure, HttpOnly, SameSite) decide whether cookies leak over HTTP, to JavaScript, or cross-site.

Their absence is not a vulnerability by itself — it is a note that tells you where to look harder. A missing CSP on a page with reflected input is worth a probe; on a static page it is trivia. Context decides severity, always.

Redirects and authentication

The most common auth pattern on the web is the login redirect: unauthenticated GET /admin → 302 → /login. When you see it, the server is behaving. What you test next is whether the behavior holds everywhere: direct object URLs, API endpoints serving the same data, HTTP methods beyond GET, and trailing-slash or case variants of the path. Enforcement that covers the front door but not the side doors is one of the most reported finding classes in bounty programs.

Key takeaways

• Read status + Location + security headers on every response; record all three.
• 403 means guarded (test authorization); 404 means absent (move on); 500 means your input did something (note the payload).
• Missing headers are notes, not findings — severity comes from what the page does with input.