ROT HACKERSACADEMYStart learning
Courses/WSHawk Practitioner/Lesson 03
01.03 / 40 min

Capture and replay HTTP

Build a request in HTTP Forge, replay it under different identities, and distinguish raw headers from stored identity state.

By the endSend a raw requestReplay as a stored identitySave a reusable template
Controlled exercise

Use only the Academy Lab on 127.0.0.1:5177. Do not copy these tests to a public system without explicit written authorization.

01

Send the owner request

Open Web → HTTP Forge. Set method GET, paste the secure resource URL, leave the body empty, select User B, then choose Replay as Identity.

GET http://127.0.0.1:5177/api/resources/resource-b
Expected result

User B receives 200 and the body owner is user_b.

02

Replay the same object as User A

Change only the identity to User A. Keep the method, URL, and body identical so identity is the single variable.

Expected result

User A receives 403 from the secure route.

03

Save the request template

Name the request resource-b-secure and save it as a project-backed replay template. Reload it and verify no stale manual Authorization header overrides the selected identity.

MASTERY CHECKPOINT

Prove it before moving on.

The saved template produces 200 for User B and 403 for User A without manual token editing.