Lion Cipher Lab

See HTTP/1.1 and HTTP/2 with your own eyes: raw text bytes, keep-alive, and binary framing

• Foundations
• Intermediate
• ~50 min
• Free · no account required

Why it matters

Almost everything you will ever attack, defend, log, or debug speaks HTTP, and the two versions in front of you behave so differently that a person who only knows one is regularly surprised by the other. HTTP/1.1 is plain text you can read and type by hand — which is why so many classic attacks and quick debugging tricks are possible. HTTP/2 is a binary, multiplexed, header-compressed protocol where a request is a set of frames on a stream — which is why a whole class of modern request-smuggling and desync bugs exists at the seam between the two. Seeing both with your own eyes, on your own…

What you'll learn

• reading a raw HTTP/1.1 request and response byte for byte
• recognising CRLF line framing and the header/body boundary
• persistent connections (keep-alive) and why they matter
• standing up a local HTTP/2 server and negotiating it over TLS (ALPN)
• reasoning about HTTP/2 binary frames, streams, multiplexing and HPACK
• choosing HTTP/1.1 vs HTTP/2 vs HTTP/3 for a real situation

Steps in this lab

1. What HTTP is, and why there is more than one version
2. Confirm curl can speak both versions
3. Stand up a throwaway HTTP/1.1 server on your own machine
4. Make your first request and read the protocol lines
5. See the literal bytes: CRLF framing and the header/body boundary
6. Type an HTTP/1.1 request by hand
7. Persistent connections: keep-alive, and why it was a big deal
8. The wall HTTP/1.1 hits: one request at a time (head-of-line blocking)
9. Stand up a local HTTP/2 server with Caddy
10. Make the same request over HTTP/2 and watch it change shape
11. What actually changed: frames and streams instead of lines of text
12. Why headers got compressed: HPACK
13. See multiplexing: many requests, one connection, at once
14. When to reach for which — and why HTTP/2 wasn't the end
15. The security seam you just learned to see
16. Clean up, and what you proved

Open the full interactive lab →