Skip to content

https

The https identity: HTTP over TLS. Every field and what is required.

https is HTTP over TLS (RFC 2818). It uses the http fields: encoding (required), payload, path, headers, and capture. The target is a base URL with an https:// scheme. The http identity also covers both schemes, so a plain http solution works against an https target; https exists so a solution can name the secure scheme explicitly.

Example

https reflect
  encoding: query
  meaning: send a unique marker and confirm it comes back over TLS
  payload: REFLECTED_7x7
  assert: contains "REFLECTED_7x7"

Write attacks down. Verify them.

Download the binary, point it at a target you own, and get a verified result. The corpus is open and the format is plain text.

Get started Read the docs