// RFC STANDARDS & WEB SECURITY TELEMETRY

HTTP STATUS CODES CHEATSHEET

An exhaustive field reference of standard HTTP response codes (1XX Informational, 2XX Success, 3XX Redirection, 4XX Client Errors, and 5XX Server Errors). Every status code features a concise 2–3 line Hinglish explanation with its critical impact on web penetration testing and defensive auditing.

18 Codes Loaded

FILTER CLASS:

100 1XX Informational

Continue

💡 Hinglish Explanation Client ko batata hai ki initial headers mil chuke hain aur request body send karna continue kar sakte ho. Large payload uploads se pehle bandwidth save karne ke liye use hota hai.

Security Context: Bypassing initial WAF header checks ya large file streaming flaws inspect karne ke kaam aata hai.

Request Streaming

101 1XX Informational

Switching Protocols

💡 Hinglish Explanation Server client ki request par protocol switch kar raha hai (jaise HTTP se real-time WebSocket protocol par upgrade hona).

Security Context: Agar origin header validation weak ho toh Cross-Site WebSocket Hijacking (CSWSH) attack ho jata hai.

WebSocket Upgrade

200 2XX Success

OK

💡 Hinglish Explanation Request bilkul successful thi aur server ne requested resource aur payload return kar diya. Normal web browsing ka standard success status code hai.

Security Context: Gobuster aur Dirsearch fuzzer 200 status code dekh kar confirm karte hain ki endpoint live aur accessible hai.

Standard Success

201 2XX Success

Created

💡 Hinglish Explanation Server par request successfully process hui aur naya resource (new user account, post, file) successfully create ho gaya.

Security Context: API testing mein mass account registration, file uploads aur database insertion verification ke liye dekha jata hai.

Resource Generated

204 2XX Success

No Content

💡 Hinglish Explanation Server ne request successfully execute kar di, par response body mein koi data wapas nahi bhej raha (jaise delete operation ya autosave).

Security Context: Bug bounty aur API testing mein confirm karta hai ki delete/update request backend par bina error execute ho gayi.

Silent Success

301 3XX Redirection

Moved Permanently

💡 Hinglish Explanation Requested URL permanent taur par naye URL par shift ho chuki hai. Browser future requests automatically naye address par forward karta hai.

Security Context: Agar redirect parameter sanitize na ho toh Open Redirect vulnerability se users phishing sites par redirect ho jaate hain.

Permanent Redirect

302 3XX Redirection

Found (Temporary)

💡 Hinglish Explanation Resource temporarily kisi doosri jagah available hai (jaise login hone ke baad dashboard par redirect karna).

Security Context: Authentication flows aur OAuth token passes mein parameter manipulation se token interception testing hoti hai.

Temporary Redirect

304 3XX Redirection

Not Modified

💡 Hinglish Explanation Client ke browser cache mein latest version pehle se maujood hai aur server par koi file change nahi hui, isliye fresh data download nahi hota.

Security Context: Web Cache Poisoning aur Web Cache Deception exploits mein header manipulation audit karne ke liye zaroori hai.

Cache Verified

400 4XX Client Error

Bad Request

💡 Hinglish Explanation Client ne invalid syntax, malformed parameters ya corrupt request bheji jisko server parse aur samajh nahi pa raha hai.

Security Context: SQLi, HTTP Request Smuggling ya malformed JSON payloads test karte waqt server 400 return karta hai.

Syntax Error

401 4XX Client Error

Unauthorized

💡 Hinglish Explanation Resource access karne ke liye valid authentication credentials (username/password ya Bearer token) chahiye jo missing ya invalid hain.

Security Context: Login brute force attacks (Hydra/Burp Intruder) mein galat password hone par 401 response trigger hota hai.

Missing Auth

403 4XX Client Error

Forbidden

💡 Hinglish Explanation Server tumhari identity samajh gaya hai, par tumhare account ke paas us resource/file ko dekhne ki authorization permission nahi hai.

Security Context: 403 Bypass techniques (X-Forwarded-For: 127.0.0.1, path case manipulation `/admin` vs `/Admin`) se test hota hai.

Authorization Denied

404 4XX Client Error

Not Found

💡 Hinglish Explanation Requested webpage ya endpoint server par exist nahi karta ya jaan-boojh kar hide kiya gaya hai.

Security Context: Content discovery tools 404 responses ko filter out karke hidden files (`.env`, `backup.zip`, `admin.php`) uncover karte hain.

Endpoint Missing

429 4XX Client Error

Too Many Requests

💡 Hinglish Explanation Client ne limited time span mein allowed threshold se zyada requests send kar di hain (Server Rate Limiter ne block kar diya).

Security Context: Brute force aur scrapers ko rokne ke liye use hota hai; pentester IP rotation aur header spoofing se isko test karte hain.

Rate Limiter Triggered

500 5XX Server Error

Internal Server Error

💡 Hinglish Explanation Server ke backend code ya database query mein koi unhandled exception ya fatal crash aa gaya jo server handle nahi kar paya.

Security Context: SQL Injection aur Server-Side Template Injection (SSTI) testing mein 500 error aksar internal database stack trace leak karta hai.

Backend Crash / Leak

501 5XX Server Error

Not Implemented

💡 Hinglish Explanation Server requested HTTP method (jaise PUT, TRACE ya custom verb) ko recognize nahi karta ya us functionality ko support nahi karta.

Security Context: Server fingerprinting aur verb tampering testing mein allowed HTTP methods identify karne ke kaam aata hai.

Unsupported Method

502 5XX Server Error

Bad Gateway

💡 Hinglish Explanation Edge server ya reverse proxy (Cloudflare/Nginx) ko peeche chal rahe actual application server se invalid ya corrupt response mila.

Security Context: Backend Node.js/Python server crash hone ya heavy denial-of-service stress test ke waqt trigger hota hai.

Proxy Relay Failure

503 5XX Server Error

Service Unavailable

💡 Hinglish Explanation Server temporarily overloaded hai ya maintenance mode chal raha hai, isliye requests accept nahi kar pa raha.

Security Context: DoS testing mein server capacity exhaust hone aur circuit breaker triggering verify karne ke liye monitor hota hai.

Overload / Maintenance

504 5XX Server Error

Gateway Timeout

💡 Hinglish Explanation Reverse proxy ya load balancer ne backend application server se response aane ka wait kiya par allotted timeout limit expire ho gayi.

Security Context: Time-Based Blind SQLi (`WAITFOR DELAY`, `sleep(10)`) test karte waqt time-out confirm hone par vulnerability prove hoti hai.

Timeout Exceeded