How the web works

A web page is a conversation. Your browser sends a request — a method (GET to read, POST to send), a path like /account, maybe a query after a ?, some cookies, and headers. The server sends back a response: a status (200 ok, 404 not found, 403 forbidden), headers, and the page.

Here is the thing that makes all of security interesting: every part of the request is yours to change. The path, the query, the cookies — the browser is just the first thing that fills them in, not the last word on what they can be. A server that trusts them to be what it expected is a server you can surprise.

The tool on the next pages is a small browser. It has an address bar you can edit, a cookie drawer you can edit, and a View source tab that shows the exact text the server sent — not the tidied-up page, the raw thing. Your job each time is to find a flag shaped like froga{…} that the site did not mean to give you.