Module 3: HTTP & Chrome DevTools#
By the end, you can:
- Send a web request and inspect its response.
- Find the request behind a browser action.
- Change a page locally and explain why a reload removes the edit.
Bring:
- Chrome, curl and
~/bridge-lab. - Invented practice data for httpbin, which echoes what you send.
Practice roadmap#
Start where you are · Choose your target
Try Mayank's TDS Games challenge. Build your skills with 01 for browser investigation, 02 for API testing, and 03 for Natas web-security puzzles. Choose your starting level; use the request and Network labs below when you need a foundation.
TDS Games · Debug Paradox ↗
Made by Mayank · Chrome DevTools · Sign in to play
Read the workshop guide ↗, then investigate the game's twelve broken campus systems. Look for clues in response headers, HTML comments and console output. Use Network, Elements and Console to test one hypothesis at a time, then explain the evidence behind each solution.
Challenge goal: solve three scenarios and record the clue, DevTools panel and action that led to each solution.
- 01Foundation · Investigate
SolveJS: DevTools puzzles ↗
Browser · Free account for full catalog · Selected demos without login
Recover a response-header or XHR flag in Find the flag. Then solve The role cookie and the Medium Forged role token puzzle in Tamper the request. Compare requests before and after changing the cookie.
Move on when: three puzzles pass and you can locate response evidence and explain how cookie changes affected the server reply.
- 02Intermediate · Test
API Challenges ↗
Free · curl or API client · Temporary challenger ID; no personal account
Create a session with
POST /api/challengerand reuse itsX-CHALLENGERheader. Complete a TODO create/read/update/delete cycle, then filtering, pagination, unsupported Content-Type and failed-authentication challenges. Use the board's API documentation to construct your requests.Move on when: eight relevant board entries pass and you can explain the difference between a
415input-format rejection and a401authentication failure. - 03Optional stretch · Unlock
OverTheWire · Natas ↗
Free · Browser + DevTools or curl · Published starter credentials
Use the game mission below to reach
natas3, then attempt the next levels independently. Each recovered password opens the next level's website. Inspect page content and requests, replay them with curl when useful, and keep notes on why each clue works. Continue beyond the guided levels toward your own target.Target: reach
natas6and explain three independently solved levels using request, response or page evidence.
Build request skills in labs 3.1–3.2 and the Network lab. Save your API Challenges session before breaks; idle data may expire. Keep recovered Natas passwords out of your lab notes and practise only on the named game hosts.
Game mission: NatasLook behind the page. Find the next clue. | 3 challenges
Start here#
- Game: Natas, a web-security training game.
- Flow: find a password → open the next level’s URL → enter it in the browser’s login dialog.
- Goal: log into
natas3. - Scope: use only the designated game hosts.
- Open Level 0 in Chrome.
- In the browser’s login dialog, enter
natas0for both Username and Password, then click Sign in. - Check the page heading is
natas0, then start Challenge 1.
- Private notes: keep recovered passwords outside
bridge-lab.
Where does the password go? Browser login vs “Submit token”
- To advance: open the next Natas URL. Enter that level’s username and the recovered password in the browser’s login dialog (HTTP Basic authentication).
realwechallform/ “Submit token”: submits towechall.netfor the optional WeChall scoreboard; leave it unchanged for this lab.type="hidden": hides those fields from the page; it does not disable them. Revealing or editing them does not open the next Natas level.
Challenge 1: Inspect the HTML comment (Level 0 → 1)#
- Right-click the page → Inspect.
- Select Elements and expand
<body>→<div id="content">. - Look for a comment:
<!-- ... -->.
Walkthrough: read the hidden comment
- Inside
div#content, find the comment identifying the password fornatas1. - Copy only the password, without the surrounding comment text.
- Open Level 1 in a new tab.
- In the browser’s login dialog, enter Username:
natas1. - Paste the recovered value into Password, then click Sign in.
- Success: the page heading is
natas1. - Lesson: HTML comments can contain information that the visible page does not display.
Challenge 2: Inspect when right-click is blocked (Level 1 → 2)#
- Try right-clicking; the page blocks the menu.
- Open DevTools with Ctrl+Shift+I (Windows/Linux) or Cmd+Option+I (macOS).
- Select Elements and inspect the HTML again.
Walkthrough: use the keyboard to open DevTools
- Expand
<body>→<div id="content">in Elements. - Find the comment identifying the password for
natas2. - Copy only that password.
- Open Level 2 in a new tab.
- In the browser’s login dialog, enter Username:
natas2. - Paste the recovered value into Password, then click Sign in.
- Success: the page heading is
natas2. - Lesson: blocking right-click does not prevent you from inspecting the page’s HTML.
Challenge 3: Follow the image’s HTML path (Level 2 → 3)#
- Right-click → Inspect and open Elements.
- Expand
<body>→<div id="content">. - Find the
<img>tag and read itssrcpath.
Walkthrough: follow the resource path
- Find
<img src="files/pixel.png">; the clue is thefiles/directory. - In the authenticated Level 2 tab, change the address to
http://natas2.natas.labs.overthewire.org/files/. - Open
users.txtfrom the directory listing. - Find the
natas3entry; copy the password after its colon. - Open Level 3 in a new tab.
- In the browser’s login dialog, enter Username:
natas3. - Paste the password from
users.txtinto Password, then click Sign in.
- Success: the page heading is
natas3. - Lesson: an HTML resource path can reveal a directory containing other files.
Stuck?
- Comment missing: expand
div#content. In DevTools settings → Preferences → Elements, enable Show HTML comments if disabled. - Find a clue: click inside Elements, press Ctrl+F / Cmd+F, and search for
passwordorpixel.png. 401: match the username to the hostname and use the previous level’s password, without comment markers or extra spaces.- No login dialog: if the correct level already loads, the browser has remembered its credentials; continue from that page.
- Reference: official Natas instructions · Chrome’s Elements guide.
Keep the skill:
- Record each clue’s location and why it worked in
notes/http.txt. - Leave out passwords and copied credential-bearing requests.
- Try Level 3 independently using the official game description.
Your lab#
3.1 · Send a request and read the reply
curl -i 'https://httpbin.org/get?topic=python&module=3'Check:
- Status: a success response.
- Content-Type: JSON.
args: both query values appear.
Read the command:
-iincludes response headers.Quotes keep the shell from treating
&as a background-command operator.Client: curl or a browser sends a request.
Server: returns a response.
HTTPS: encrypts the transport.
Client -- method + URL + headers + optional body --> Server
Client <-- status + headers + response body -------- Server| URL part | In this request |
|---|---|
| Scheme / host | https / httpbin.org |
| Path | /get |
| Query parameters | topic=python, module=3 |
- Endpoint: an address that accepts requests.
- API: defines how software can use endpoints.
- JSON: a text data format;
{"module":3,"ready":true}contains a number and a boolean. - JSON syntax: keys and strings use double quotes.
Your turn:
- Change only
topic. - Predict which response field changes, then run again.
- Save and format the body:
cd ~/bridge-lab
curl -sS 'https://httpbin.org/get?topic=linux' -o notes/http-get.json
python3 -m json.tool notes/http-get.json-sS: hides progress but shows errors.-o: writes the body to a file.- Check: the formatted
argscontains"topic": "linux".
If formatting fails:
- Inspect the file; a service error may return HTML instead of JSON.
- Record the status/error.
- Retry later.
3.2 · Compare bodies, methods and status codes
Send a JSON body:
curl -i 'https://httpbin.org/post' \
-H 'Content-Type: application/json' \
-d '{"learner":"Explorer","module":3}'-H: adds a request header.-d: supplies a body and selects POST by default.- Backslashes: continue this command across lines.
- Check: your object appears in the response’s
jsonfield.
| Part | Question it answers |
|---|---|
| Method and URL | What action, at which address? |
| Request headers and body | What extra information/data did I send? |
| Status and response headers | What happened; what type of data came back? |
| Response body | What did the server return? |
Try methods#
curl -i -X PUT 'https://httpbin.org/put' -H 'Content-Type: application/json' -d '{"ready":true}'
curl -i -X PATCH 'https://httpbin.org/patch' -H 'Content-Type: application/json' -d '{"topic":"git"}'
curl -i -X DELETE 'https://httpbin.org/delete'-X: chooses a method explicitly.- GET: retrieves data.
- POST: submits data.
- PUT: commonly replaces a resource.
- PATCH: changes part of a resource.
- DELETE: requests removal.
- httpbin: echoes these actions; it does not maintain a learner record.
Predict a response#
curl -i 'https://httpbin.org/status/404'
curl -i 'https://httpbin.org/status/500'
curl -i 'https://httpbin.org/redirect/1'
curl -i -L 'https://httpbin.org/redirect/1'| Family | Meaning | Example |
|---|---|---|
2xx | Success | 200 |
3xx | Redirect | 302; -L follows it |
4xx | Request cannot be fulfilled as sent | 401 authentication required; 404 not found |
5xx | Server-side failure | 500 |
Check:
- Compare the two redirect calls.
- Find the successive response headers shown by
-i -L.
Your turn:
- Record one method, status and echoed field in
notes/http.txt. - Explain whether
404is the same as a connection timeout.
Check your explanation
404: an HTTP response arrived, but the resource was not found.- Timeout or DNS failure: may occur before any HTTP response arrives.
- Response received: does not guarantee success.
3.3 · Find the request behind an action
Open Chrome’s Network demo.
- Open DevTools → Network, then reload; each row is a request/resource.
- Click Get Data on the demo.
- Filter for
getstarted.jsonand select it. - In Headers, find Request URL, Request Method and Status Code.
- Compare request and response headers.
- Read Response (raw data), Preview (formatted view) and Timing (timeline).
Check:
- Name the action that caused the request.
- Find one returned value.
- For panel help, use the official tutorial.
Replay your own harmless request#
- Open Network, then visit
https://httpbin.org/get?topic=browser. - Select its document request.
- Right-click → Copy → Copy as cURL.
- Inspect the command, then run it in your terminal.
- Compare: the endpoint and query match; headers may differ.
- Private requests: commands from signed-in sites may contain cookies/tokens. Do not share them.
Explore suggestions#
- Open Google Search and clear Network.
- Type
weather in chwithout submitting. - Inspect new requests for your query and suggestion data.
- Try Fetch/XHR, then All if needed.
- Record: host/path, method/status and evidence connecting the response to the suggestions.
- Evidence:
suggestin a filename is a clue; verify the response data. - Fallback: results vary by region/session. If no request appears, use the Get Data demo.
- API distinction: an internal endpoint may not be a supported public API.
3.4 · Change what your browser displays
- Elements: shows the DOM, the browser’s current page representation.
On Google’s homepage:
Right-click the logo → Inspect, or use the element picker: Ctrl+Shift+C / Cmd+Option+C.
Select the image or its wrapper. Under
element.stylein Styles, add:filter: grayscale(1); transform: rotate(-8deg);Uncheck each property to compare its effect.
Reload; with normal settings and no local overrides, the edits disappear.
- Check: explain why only your page view changed.
- Fallback: if the doodle is difficult to select, edit a heading in the official DOM demo.
Your turn:
- Load a page, then disconnect from the network.
- Edit its style.
- Explain why editing the existing DOM can work while fetching a new page cannot.
Finish without copying#
- Inspect a new request.
- Identify its method, URL, status and one response value.
- Explain which browser action triggered it and how you know.
- I reached
natas3and can explain all three clues. - I sent GET and POST requests and found my input in the replies.
- I distinguished an HTTP error from a connection failure.
- I changed a page locally and verified what reload did.
Explore:
- Try httpbin’s
/headersendpoint with-H 'X-Lab: bridge'. - Predict where your custom header appears, then verify it.
- Keep observations in
notes/http.txt.
Next: Module 4: Git & GitHub →