Raw HTTP Request Builder
Build a raw HTTP request from method, path, headers, and body — see exactly what goes over the wire.
Every web attack is, underneath, a request you constructed by hand. Seeing the raw text — method, path, headers, blank line, body — removes the mystery from tools like Burp and curl, because they are all just editing this.
How to use it
- Pick a method: GET, POST, PUT, DELETE or PATCH.
- Set the path and host, then add headers one per line as Key: Value.
- Add a body if needed and read the assembled raw request.
What to take away
The blank line is structural
Exactly one empty line separates headers from body. Get it wrong and the server reads your body as headers — which is the basis of request smuggling.
Content-Type changes how the body is parsed
The same bytes are read differently as JSON, form-encoded or multipart. Flipping it is a standard trick for reaching a different parser.
The browser is not the boundary
Client-side validation only shapes what the browser sends. Anything you can construct here, an attacker can send directly — which is why server-side validation is the only kind that counts.
Frequently asked questions
What is the difference between GET and POST, really?
Convention and placement. GET carries parameters in the URL and should not change state; POST carries them in a body. Nothing enforces this — a GET that deletes something is a bug, not an impossibility.
Does this tool send the request?
No. It assembles and displays the raw text so you can see the structure. Sending it is a job for curl or an intercepting proxy against a target you are allowed to test.
Why does HTTP use \r\n line endings?
The specification inherits them from earlier internet text protocols. It matters because parsers disagree about lone \n, and that disagreement is exactly what smuggling attacks exploit.
Where this fits in the course
This security tool pairs with Path 10 — Fundamentals — see all 26 learning paths.
It runs entirely in your browser: nothing is uploaded, no account is needed, and it is free.
Related
- Security Header Analyzer — Paste HTTP response headers and get a graded report on the security headers present and missing.
- CSRF Playground — A "bank" transfer endpoint trusts your cookie alone. Watch a malicious page forge a request on your behalf, then see a CSRF token stop it cold.
- SSRF Playground — A "fetch this URL for me" feature with no allowlist. Point it at internal-looking addresses and see what it leaks.
- User-Agent String Parser — Break down a User-Agent string into OS, browser, and version — and flag common automated-client patterns.