HTTP Can Do That?!
summary
Shows concrete exploits and experiments: malformed requests that plant spam in 404 logs, an API that accepts POST but not GET, and a toy server written in Python using the requests library and netcat to prove things. Demonstrates a working DELETE endpoint, measures HEAD returning metadata in ~163ms versus GET at ~1.3s, abuses Host/header mismatch to poison admin logs, and collects weird real-world status codes (126, 999) plus the useful 451 legal-blocking code.
AI-written summary · about
chapters (13)
- 0:00Start
- 4:17Example Request
- 4:49Example Response
- 10:00Implementing DELETE
- 17:16You don't need the body to check
- 18:03Popular headers include
- 20:43An unpopular header
- 23:53Host & path work together
- 27:44A spam story
- 29:38Define your own header!
- 32:18Status (response) codes
- 33:27451 Unavailable For Legal Reasons
- 34:49WTF responses
