Not every practical appsec interview opens with a live exploit. Sometimes it's a terminal, one curl -I against a URL, and a single question: what's wrong with this response. It's a fast filter, and it doesn't separate people who understand HTTP from people who don't. It separates people who habitually read the header block from people who scroll past it straight to the page content, in an interview and in real recon.
That second group freezes on this question a lot, and it's not really about the interview. If you've spent months of recon jumping past headers to get to the HTML, that habit costs findings in the field the same way it costs points in the room, because a header dump is often the fastest read you'll ever get of a target's whole security posture, and skipping it means starting every engagement a step behind before you've even loaded the page.
What's actually in that block worth reading, every time:
No Strict-Transport-Security means the app never tells a browser to refuse a downgraded connection. One unlucky http:// link, one captive-portal-style position on the network, and there's a real path to intercept traffic on a site that otherwise looks all-HTTPS. A verbose Server or X-Powered-By header naming the exact framework and version hands over the search term for known issues in that specific build, before anyone has touched the application logic. A missing X-Content-Type-Options: nosniff leaves room for a browser to guess a content type in a way that turns an upload endpoint into something it was never meant to serve. None of these are exotic. They're the first five seconds of reading a response, once reading it is a habit instead of a step you skip.
That's the actual skill: not memorizing a checklist once, but reading enough header dumps that a missing one jumps out the way a missing semicolon does to someone who reads code all day. It stops being something you check for and becomes something you'd notice was absent.
Codelivly's free HTTP Headers CTF is this exact exercise in miniature: one response, read the headers, find what's actually in them. The habit it builds is the same one the HTTP Protocol Book goes deep on, headers and status codes, HTTPS and TLS, HTTP/2 and HTTP/3, and reading a response with curl and Postman like it's actually trying to tell you something. It is.
Top comments (0)