API › Module 2 › Lesson 2
curl Headers on YOUR Lab
Headers are metadata that change meaning — curl -D - on 127.0.0.1:8811.
Visual · rest_curl_headers
curl -i/-D - reads headers. 127.0.0.1:8811.
Opening
The body is the letter. The headers are the envelope stamps — Content-Type, Authorization, Cache-Control.
REST clients speak headers as loudly as JSON. Content-Type says how to parse. Accept says what you want. Authorization carries identity material (later modules). Server headers may leak versions — useful on YOUR lab, not a warrant to fingerprint the internet. Original Cyberlium. Practice curl -sS -D - against 127.0.0.1:8811. You will NOT point Burp at stranger hosts “for header practice,” not hydra Authorization, not sqlmap because a header looked odd. Next: JSON Contracts and Content-Type.
1. Request headers you control on purpose
On YOUR lab, set Content-Type: application/json when you POST JSON. Set Accept if the toy negotiates. Leave Authorization empty until Module 3 — or use a lab token the course gives you.
Wrong Content-Type is a common self-goal: the server returns 415 or silently mis-parses. Practice that failure on loopback, not on a merchant checkout API.
Command guide
Try these commands — Request headers you control on purpose
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
HTTP headers — https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers Content negotiation — https://developer.mozilla.org/en-US/docs/Web/HTTP/Content_negotiation
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS -D - -o /dev/null http://127.0.0.1:8811/
curl -sS -H "Accept: application/json" http://127.0.0.1:8811/items
curl -sS -H "User-Agent: CyberliumLab/1.0" -o /dev/null -w "custom UA %{http_code}
" http://127.0.0.1:8811/Primary tools to practice this lesson: curl. Reference sites: HTTP headers (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers); Content negotiation (https://developer.mozilla.org/en-US/docs/Web/HTTP/Content_negotiation). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Response headers as a reading list
curl -D - prints response headers before the body. Note status line, Content-Type, and any X-Cyberlium-Lab teaching header. WWW-Authenticate may appear with 401 — literacy, not a hydra cue.
Server and X-Powered-By on YOUR toy are fine to log. On unowned hosts, collecting banner databases is out of this course’s homework.
3. Verbose is a lab tool, not a LAN habit
curl -v shows the wire conversation on dests YOU own. Do not -v against third-party APIs to “collect tokens.” Do not save stranger Authorization headers into git.
Ship a note with one successful -D - transcript from 127.0.0.1:8811. Redact any real secrets if you pasted them by mistake.
4. What you ship: one curl -D - transcript from YOUR lab
Saved headers from 127.0.0.1:8811. Named Content-Type/Accept/status. DEMO GATE. No stranger banner DB. No hydra on WWW-Authenticate.
5. What you record before the next lesson
Date. curl -D - excerpt. Content-Type observed. SAFE 127.0.0.1:8811. File t13-m02-l02-curl-headers.txt chmod 600.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
Wrong
curl -v random SaaS to harvest Authorization. hydra because WWW-Authenticate appeared. Commit tokens to a public repo.
Right
Transcript from loopback only. Next: JSON Contracts and Content-Type.
Mission: read the envelope on loopback
1) / STOP if router. 2) curl -sS -D - http://127.0.0.1:8811/ (start toy if needed). 3) Note status and Content-Type in a 600 file. Never harvest stranger headers.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor for curl flag hints — not for a list of APIs that leak Server banners.
Knowledge Check
APPLY: You POST JSON but forget Content-Type. Likely literacy outcome on a picky lab?
Multiple choice
Knowledge Check
APPLY: True or False: WWW-Authenticate on YOUR 401 response means start hydra.
True or False
Knowledge Check
APPLY: Best dest for curl -D - practice in Module 2?
Multiple choice