Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Debugging HTTP

Lorna Mitchell
February 22, 2014

Debugging HTTP

Debugging HTTP talk from PHPUK in 2014

Lorna Mitchell

February 22, 2014
Tweet

More Decks by Lorna Mitchell

Other Decks in Technology

Transcript

  1. Fault-Finding HTTP ... is just like fault-finding elsewhere in a

    web project Seeing the problem is usually harder than fixing it • Can you reproduce the problem? • Start wireshark, inspect traffic • Use Curl to try simplest case, then step up • Charles can transform requests
  2. Curl is Your Friend -X [verb] The verb to use

    for this request -H "[Header: value]" A header to send. Use as many times as needed -d [value] Either the whole body data as a string, a filename, or a key/value pair -s The "silent" switch, to hide curl's progress meter when piping the output to something else -c [filename] Where to store any incoming cookies for future use -b [filename] Cookies to send with the request -v to both body and headers, in the request and response
  3. Python's JSON Library A python tool, handily available via CLI

    [some json] | python -mjson.tool http://docs.python.org/2/library/json.html
  4. Wireshark Copies traffic from your network card to allow you

    to view it • Quick way to observe without adding debug to your application • Can use tcpdump to capture on a server, wireshark to inspect later • Save and load sessions https://www.wireshark.org/
  5. Charles Proxy Multi-platform Web Debugging Proxy http://www.charlesproxy.com/ • Observe requests

    • Firefox plugin • Change requests • Use Charles as a network proxy • Repeat/save requests (detailed article: http://lrnja.net/ZuiDYJ)
  6. Debugging SSL You need to authorise the attack Add an

    exception, or install the Charles CA in your browser
  7. Other Excellent Tools • httpie https://github.com/jkbr/httpie • Fiddler http://www.telerik.com/fiddler •

    Postman (Chrome) http://getpostman.com/ • RESTClient (Firefox) http://restclient.net/ • mitmproxy http://mitmproxy.org/ • jq http://stedolan.github.io/jq/