http

http is an HTTP exchange. The encoding field decides where the payload rides, and the step’s fields shape the request. The target is a base URL; the scheme (http or https) comes from it.

Fields

encoding field

Required. Where the payload goes:

value	the request it makes
query	GET target?param=value
form	POST application/x-www-form-urlencoded
json	POST {"param": "value"}
raw-json	POST, the body IS the value (structured endpoints like the WP batch route)
plain	GET of a fixed path (fetch a written shell)

payload field

Optional. The value to send. Needed for the query, form, json, and raw-json encodings.

path field

Optional. Extra path appended to the target URL. Example: /api/session.

headers field

Optional. Extra request headers, one name and value each.

capture field

Optional. Pulls a value out of the response for later steps. The pattern runs over the full response text: the status line, the headers (including a redirect’s Location), and the body.

http get-token
  encoding: json
  path: /api/session
  capture csrf: "\"csrf\"\\s*:\\s*\"([^\"]+)\""
  assert: contains "\"csrf\""

Later steps reference {csrf}.

param, on the solution

The solution-level param names the input parameter used by the query, form, and json encodings. For example, a template renderer solution sets param to template so the payload reaches the right field.

Example

http reflect
  encoding: query
  meaning: send a unique marker in the template param and confirm it comes back
  payload: REFLECTED_7x7
  assert: contains "REFLECTED_7x7"