REST Lab — Methods and Bodies
Exercise GET/POST + headers + JSON on 127.0.0.1:8811 —.
Visual · rest_lab_methods_bodies
Lab: methods, curl -D -, JSON. Bind 127.0.0.1:8811.
One listener. Several verbs. Your notes must show status and body — not a feeling.
Lessons 1–3 named methods, headers, and JSON. This lab ships a short transcript: GET a resource, POST a JSON body with Content-Type, capture -D - headers, and record at least one 4xx you caused on purpose. All of it on 127.0.0.1:8811. Original Cyberlium. Refuse 0.0.0.0. No sqlmap, no hydra, no stranger OpenAPI imports. Next: Quiz — REST Literacy.
1. Lab contract: GATE, bind, then verbs
. Confirm the helper binds 127.0.0.1:8811. Start YOUR REST toy.
Plan two calls before you type: one GET, one POST with JSON. Write the expected status in the note first — then compare.
Command guide
Try these commands — Lab contract: GATE, bind, then verbs
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Postman REST — https://learning.postman.com/docs/getting-started/first-steps/sending-the-first-request/ RFC 8259 JSON — https://www.rfc-editor.org/rfc/rfc8259
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
curl -sS -X POST http://127.0.0.1:8811/items -H "Content-Type: application/json" -d '{"name":"rest-lab","qty":1}' | jq .
curl -sS -o /dev/null -w "PATCH %{http_code}
" -X PATCH http://127.0.0.1:8811/items/1 -H "Content-Type: application/json" -d '{"qty":2}'Primary tools to practice this lesson: curl, jq. Reference sites: Postman REST (https://learning.postman.com/docs/getting-started/first-steps/sending-the-first-request/); RFC 8259 JSON (https://www.rfc-editor.org/rfc/rfc8259). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Capture envelopes and bodies
Use curl -sS -D - for both calls. Save headers and bodies under cyberlium-lab. Confirm Content-Type on the POST.
Cause one deliberate client error (wrong path or bad JSON) and keep that transcript too. Errors on YOUR lab are teaching, not incidents.
3. Cleanup and ethics check
Stop the pid you started. chmod 600 notes. Grep for 0.0.0.0 and stranger URLs — neither should appear as dests.
If you pasted a real token by mistake, rotate it and scrub the file. Quiz is next.
4. What you ship: GET + POST transcripts and one intentional 4xx
Two success transcripts and one 4xx on 127.0.0.1:8811. Headers saved. DEMO GATE. Process stopped. No 0.0.0.0. No sqlmap/hydra.
5. What you record before the next lesson
Date. GET status. POST status. 4xx status. Bind 127.0.0.1:8811. File t13-m02-l04-rest-lab.txt chmod 600.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
- Wrong: Import a public OpenAPI and fuzz it. Leave the toy on 0.0.0.0. hydra because you saw 401.
- Right: Loopback transcripts only. Next: Quiz — REST Literacy.
Mission: prove REST literacy with evidence
1) / STOP if router. 2) Start 127.0.0.1:8811 toy. 3) GET, POST JSON, capture one 4xx. 4) Stop pid. chmod 600. Never hit stranger APIs.
Stuck? Ask Cyberlium AI Mentor
If POST returns 415, check Content-Type before blaming the framework.
APPLY: Lab snippet binds 0.0.0.0:8811. You:
APPLY: True or False: An intentional 404 on YOUR lab is valid evidence for this lab.
APPLY: You see 401 on YOUR POST. Next ethical step?