# Web Fundamentals | TryHackMe # ROOM INFO **.NAME**:Web Fundamentals **.Profile**: [tryhackme.com](https://tryhackme.com/room/webfundamentals)**.Diffculty**: Easy **.Description**: Learn how the web works! * **Task 1**: Introduction and objectives: This room is designed as a basic intro to how the web works. "We'll cover HTTP requests and responses, web servers, cookies and then put them all to use in a mini Capture the Flag at the end". That is the mission of this room so get your brain and hands ready for this. I wont explain deeply on what it's all about, you should have learnt them in the room...only guide you into getting your answers. Lets continue. ![Screenshot 2021-07-03 15:06:04.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1625339208939/GWKodFDCM.png align="center") **WELL EXPLANATORY ENOUGH!!** * **Task 2**: How do we load websites? ![Screenshot 2021-07-03 15:12:12.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1625339551622/_Njjm45GS.png align="center") NOTE: Tho in getting your answers to this questions, read through the sub topic "**Loading some content**" in the task.Done? * **Task 3**: More HTTP - Verbs and request formats: ![Screenshot 2021-07-03 15:18:00.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1625339992789/a6S78mbPb.png align="center") Not getting it? 1)Post is the "verb" used for a login because ![post.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1625340411794/0ZzGkX0iE.png align="center") 2)GET is the "verb" used to see your bank balance once you're logged in because ![get.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1625340678656/8dqu-IQkk.png align="center") 3)No,The body of a GET request does not matter because...**Mostly be Ignored** ![get request.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1625340902131/zaQysdICG.png align="center") 4)Hmm...in getting the answer for this, we need to do some research about this "**I'm a Teapot**" status code and we dont have an idea about it, look through the **Hint** if you wish but lets check it out in our browser, In mine its looks like this: ![mozila ss.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1625343371460/_cMynrUEe.png align="center") lets check it out and we got our answer: ![status code.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1625343801979/cr-UHaQEv.png align="center") 5)Status code will you get if you need to authenticate to access some content, and you're unauthenticated?...hmm using our current mozilla page we can get our answer, look left to your screen, we have something talking about authentication Lets check it out: ![http left view.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1625344163679/N3z0hFSoK.png align="center") So after reading through i found something,hope you did too? ![401 code.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1625344333447/wgMPjPPRm.png align="center") Try out the status code..Done? Good job! * **Task 4**:Cookies,tasty! ![mozilla link.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1625344529690/kLrBc4gJ6.png align="center") Dont forget to check out the [link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies) for extra info tho. * **Task 5:Mini CTF**: ![mini ctf.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1625344921681/YDUEZjLMX.png align="center") After learning about **Curl** and how to use it in making both GET and POST requests,Time to get hands dirty!! we were told that their is a web server running in MACHINE\_IP:PORT,check it out in your browser, you should get something like this: ![Screenshot 2021-07-01 08:12:47.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1625345596024/dBOhktb6d.png align="center") 1)Make a GET request to the web server with path /ctf/get: using the format: `curl http:///ctf/get` You should get your flag: ![web fundamentals1.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1625346028752/5Ozr8OA5p.png align="center") 2)Make a POST request with the body "flag\_please" to /ctf/post: using the format: `curl -X POST -d http://:/ctf/post` **Note**: -d stands for "**HTTP POST data**" You should get a flag: ![web fundamentals 2.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1625348135137/7EX1-LRnI.png align="center") 3)Make a GET request to /ctf/getcookie and check the cookie the server gives you: using this format: `curl http://:/ctf/getcookie -c -` Get the flag: ![we fundamentals 3.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1625348427600/HzicVS-eB.png align="center") **Also Note**: -c - flag is to retrieve the cookie. And Finally: 4)Set a cookie with name "flagpls" and value "flagpls" in your devtools (or with curl!) and make a GET request to /ctf/sendcookie using this format: `curl -b "body=value" http://:/ctf/sendcookie` FLAG: ![web fundamentals 3.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1625350094432/19ImmHLy0PE.png align="center") Take Note: -b is "**Body of the value**" > # THATS IT WELL DONE!! Hope this helps someone out there...**Cheers**