【TryHackMe】HTTP in Detail：WalkThrough

# 概要

TryHackMe「HTTP in Detail」のwalkthroughです。

https://tryhackme.com/r/room/httpindetail

# Task1

## **Q1**.*What does HTTP stand for?*

**A**.**HyperText Transfer Protocol**

## **Q2**.*What does the S in HTTPS stand for?*

**A**.**Secure**

## **Q3**.*On the mock webpage on the right there is an issue, once you've found it, click on it. What is the challenge flag?*

右上の`View Site`をクリックすると模擬Webサイトが表示されます。

![task1 web site.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/8700d7e8-d0d1-42ae-961c-65b114c2582f.png)

アドレスバーの左にある`赤斜め線が入った鍵マーク`をクリックするとフラグが表示されます。

![task1 address bar.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/3aaac615-2b0d-b5ea-7baf-5ed9d1fd79c6.png)

![task1 q3 flag.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/68e38492-1665-c487-26f8-dd234b87009c.png)

**A**.**THM{INVALID_HTTP_CERT}**

# Task2

## **Q1**.*What HTTP protocol is being used in the above example?*

**A**.**HTTP/1.1**

## **Q2**.*What response header tells the browser how much data to expect?*

**A**.**Content-Length**

# Task3

## **Q1**.*What method would be used to create a new user account?*

**A**.**POST**

## **Q2**.*What method would be used to update your email address?*

**A**.**PUT**

## **Q3**.*What method would be used to remove a picture you've uploaded to your account?*

**A**.**DELETE**

## **Q4**.*What method would be used to view a news article?*

**A**.**GET**

# Task4

## **Q1**.*What response code might you receive if you've created a new user or blog post article?*

**A**.**201**

## **Q2**.*What response code might you receive if you've tried to access a page that doesn't exist?*

**A**.**404**

## **Q3**.*What response code might you receive if the web server cannot access its database and the application crashes?*

**A**.**503**

## **Q4**.*What response code might you receive if you try to edit your profile without logging in first?*

**A**.**401**

# Task5

## **Q1**.*What header tells the web server what browser is being used?*

**A**.**User-Agent**

## **Q2**.*What header tells the browser what type of data is being returned?*

**A**.**Content-Type**

## **Q3**.*What header tells the web server which website is being requested?*

**A**.**Host**

# Task6

## **Q1**.*Which header is used to save cookies to your computer?*

**A**.**Set-Cookie**

# Task7

右上の`View Site`をクリックすると、`HTTPリクエスト項目`、`レスポンス表示`、`ブラウザの出力`が確認できます。

![task7 web site.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/f3ea8a18-1bdd-39a9-562a-9271256d0f18.png)

## **Q1**.*Make a GET request to /room*

**Hint**.*The answer is the text starting with the letters THM{...*

urlを`http://tryhackme.com/room`に変更し、`GET`リクエストを送るとレスポンスにフラグが表示されます。

![task7 q1.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/c747945f-dcbb-9988-9e45-120816f88f69.png)

**A**.**THM{YOU'RE_IN_THE_ROOM}**

## **Q2**.*Make a GET request to /blog and using the gear icon set the id parameter to 1 in the URL field*

keyを`id`、valueを`1`としてパラメータをセットします。

![task7 q2 set param.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/1c0eb8a3-1281-24e9-88d6-087b4d4e6a52.png)

パスを`/blog`に変更して`GET`リクエストを送信するとフラグゲットです。

![task7 q2 flag.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/980ece82-000c-9ba7-c44a-c7d80d7d6dc3.png)

**A**.**THM{YOU_FOUND_THE_BLOG}**

## **Q3**.*Make a DELETE request to /user/1*

パラメータをリセットし、リクエストメソッドを`DELETE`、パスを`/user/1`に変更して、リクエストを送信するとフラグゲットです。

![task7 q3.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/9668cc6a-3e77-2953-956b-b18ac047fe8b.png)

**A**.**THM{USER_IS_DELETED}**

## **Q4**.*Make a PUT request to /user/2 with the username parameter set to admin*

**Hint**.*Click the settings cog to add a parameter to the PUT request*

keyを`username`、valueを`admin`としてパラメータをセットします。

![task7 q4 set param.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/777887ed-907f-ad76-3538-24cf3715fd83.png)

リクエストメソッドを`PUT`に、URLパスを`/user/2`に変更してリクエストを送信するとフラグゲットです。

![task7 q4 flag.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/2503f711-18dc-7dea-9979-81dd3e689550.png)

**A**.**THM{USER_HAS_UPDATED}**

## **Q5**.*POST the username of thm and a password of letmein to /login*

**Hint**.*Delete the parameter requests from the last task, and add two more (username & password).*

パラメータを2つセットします。

1. keyを`username`、valueを`thm`でセットします
1. keyを`password`、valueを`letmein`でセットします

![task7 q5 set param.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/94e63838-d49a-60da-edae-c105e8dd14b1.png)

リクエストメソッドを`POST`、パスを`/login`に変更してリクエストを送信するとフラグゲットです。

![task7 q5 flag.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3005822/f5c6cec4-3e8e-f201-f55e-5aaff2431157.png)

**A**.**THM{HTTP_REQUEST_MASTER}**