Lion Cipher Lab
Review captured HTTP in Burp: exposed tokens, weak headers, and risky parameters
- AppSec / DevSecOps
- Intermediate
- ~40 min
- Free · no account required
Why it matters
Anyone can turn Burp Suite on and watch requests scroll past its HTTP history. The skill that actually pays is knowing what to LOOK for in that traffic — and web bugs live in the exact bytes of the request/response pair, not in a scanner's summary. This drill puts a realistic capture in front of you and teaches you to read it the way an assessor does: a session token sitting in a URL (already leaked to logs, caches and the Referer header), a login response whose cookie has no HttpOnly or Secure flag and whose headers set no CSP, a password sent in a GET, an error page that hands an attacker…
What you'll learn
- reading a raw HTTP request (method, path, query string, headers, cookies, body)
- reading a raw HTTP response (status line, response headers, body)
- spotting a secret in the wrong place — a session token or API key in a URL
- auditing response security headers (Set-Cookie flags, CSP, HSTS) and what each defends
- recognising sensitive data sent in a GET that should have been a POST
- reading a verbose error response as an information leak
- recognising the SHAPE of a broken-access-control (IDOR) bug from a predictable id
- judgment: when passive review is enough vs when confirming needs an authorized active test
Steps in this lab
- What this drill is — and why the request/response pair is where bugs live
- How to read a raw HTTP request and response
- The capture — your Burp HTTP history (read all five pairs first)
- Finding 1: a secret in the URL — treat it as already leaked
- Finding 2: audit the response headers — the cookie flags and the missing CSP/HSTS
- Finding 3: credentials in a GET that should have been a POST
- Finding 4: the error page is an information leak
- Finding 5: the SHAPE of an access-control bug — a predictable id
- When passive review is enough — and when you must actively test
- Do it better — the review habits that separate signal from noise