When HTTP servers and browsers communicate with each other, they perform interactions based on headers as well as body content.

The method:

• GET: Retrieves information from the server
• HEAD: Basically the same as GET but returns only HTTP headers and no document body
• POST: Sends data to the server (typically using HTML forms, API requests, and so on)
• TRACE: Does a message loopback test along the path to the target resourcePUT: Uploads a representation of the specified URI
• DELETE: Deletes the specified resource
• OPTIONS: Returns the HTTP methods that the server supports
• CONNECT: Converts the request connection to a transparent TCP/IP tunnel.

The server response includes a three-digit status code and a brief human-readable explanation of the status code. Below that you can see the text data (which is the HTML code coming back from the server and displaying the website contents).

NOTE It is important that you become familiar with HTTP message status codes. W3Schools provides a very good explanation at *https://www.w3schools.com/tags/ref_httpmessages.asp*.

The HTTP status code messages can be in the following ranges:

• Messages in the 100 range are informational.
• Messages in the 200 range are related to successful transactions.
• Messages in the 300 range are related to HTTP redirections.
• Messages in the 400 range are related to client errors.
• Messages in the 500 range are related to server errors.

Source: LinkedIn

HTTP URL Structure

HTTP and other protocols use URLs – and you are definitely familiar with URLs because you use them every day. This section explains the elements of a URL so you can better understand how to abuse some of these parameters and elements from an offensive security perspective.